CVE-2025-22427 AI-generated analysis

platform/packages/apps/Settings, notification listener access confirmation dialog (NotificationAccessConfirmationActivity)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (3 corrections). Verify against the commit before relying on it.

Removes the onResume/onPause overrides in Settings' NotificationAccessConfirmationActivity that passed the system-only flag SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS to Window.addFlags/clearFlags (public flag namespace), leaving only the correct onCreate handling of that flag.

Root cause

NotificationAccessConfirmationActivity overrode onResume to call getWindow().addFlags(WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS) and onPause to call getWindow().clearFlags(...) with the same constant. SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS is a system flag that belongs in LayoutParams.privateFlags; Window.addFlags/clearFlags modify LayoutParams.flags. The new test makes this explicit: after onCreate the flag must be present in privateFlags and the same bit value must be absent from flags. So the onResume call set an unintended public flag bit on the activity's window (and onPause cleared it). Per the commit message, onCreate already adds the system flag correctly (the activity still statically imports SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS at android-security-14.0.0_r29), so the onResume/onPause code was both wrong and redundant. The material does not state which public flag or window behavior that bit value triggered.

How the fix works

• src/com/android/settings/notification/NotificationAccessConfirmationActivity.java: delete the onResume() override that called getWindow().addFlags(WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS), so no stray public flag bit is set when the dialog resumes.
• src/com/android/settings/notification/NotificationAccessConfirmationActivity.java: delete the onPause() override that called getWindow().clearFlags(...) with the same constant, and drop the now-unused android.view.WindowManager import. The system flag is still applied in onCreate (per the commit message and the test).
• tests/robotests/.../NotificationAccessConfirmationActivityTest.java: add onCreate_setsWindowFlags, asserting that getAttributes().privateFlags has SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS set and getAttributes().flags does not contain that bit value.

Completeness

• The fix is a pure deletion confined to NotificationAccessConfirmationActivity. It removes the only two misuse sites shown in the diff (onResume addFlags, onPause clearFlags).
• Correct behavior relies on onCreate already applying SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS as a private flag. The onCreate body is not in the diff; only the commit message and the new test assert it.
• No other Settings activities are touched. The material shows no evidence either way about similar addFlags-with-system-flag patterns elsewhere.

Behavior changes

• The activity's window no longer gets an unintended public LayoutParams.flags bit set on resume and cleared on pause. The overlay-hiding system flag set in onCreate is now the only handling of that flag.
• The diff shows no API, string or error-path changes. The user-visible effect of removing the stray flag bit is not shown in the material.

Per major

• Android 14: same fix: commit 7255b2eaac4b in android-security-14.0.0_r19 (cherry-pick of e0510a62eba0); at android-security-14.0.0_r29 the patched region is present (8/8 lines).
• Android 15: same fix: commit 12a8312004bb in android-security-15.0.0_r7, identical diff with shifted line numbers; at android-security-15.0.0_r17 the patched region is present (8/8 lines).
• Android 16: not affected per the bulletin; android-security-16.0.0_r8 contains the patched region (8/8 lines).
• Android 17: not affected per the bulletin; android-security-17.0.0_r1 contains the patched region (8/8 lines).

Unknowns

• The onCreate code that correctly applies the system flag is not in the diff or the context; only the commit message and the test refer to it.
• The material does not state which public flag shares the bit value or what window behavior the misapplied bit caused, nor the specific EoP scenario behind the High rating.
• The bulletin lists Android 13 as affected, but the material gives no Android 13 commit or tag status.

Back to April 2025 · Findings