CVE-2025-22425 AI-generated analysis

platform/frameworks/base, packages/PackageInstaller (InstallStart activity)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

PackageInstaller's InstallStart activity stops identifying the originating package via Activity.getCallingPackage() and uses getLaunchedFromPackage() instead. A follow-up commit removes the now-dead null-check branch that replaced the calling package with the PackageInstaller session's installer package name.

Root cause

InstallStart.onCreate() got `callingPackage` from Activity.getCallingPackage(). The commit message says this API is unreliable (go/getcallingpackage-misuse). The value feeds getSourceInfo(callingPackage). Per the surrounding code comment, the uid from the resulting ApplicationInfo is preferred as the source package uid, over the uid from getLaunchedFromUid(). So the package name used to identify the install source might not match the package that actually launched the activity. Also, when getCallingPackage() returned null for a session-based install, the code filled callingPackage from sessionInfo.getInstallerPackageName(). That value comes from the session, not from the actual launcher. getCallingPackage() only reflects a caller that used startActivityForResult() and is otherwise null (general platform knowledge).

How the fix works

• Commit 8575592802b9 (android-security-14.0.0_r19), InstallStart.java:onCreate replaces `String callingPackage = getCallingPackage();` with `String callingPackage = getLaunchedFromPackage();`. This makes it consistent with the existing getLaunchedFromUid() call a few lines below.
• Commit 942884abf148 (android-security-14.0.0_r20), InstallStart.java:onCreate: per the commit message, getLaunchedFromPackage() never returns null, so the old `if (callingPackage == null && sessionId != -1)` branch could no longer run. It is rewritten as `if (sessionId != SessionInfo.INVALID_ID)` and now only reads callingAttributionTag from sessionInfo.getInstallerAttributionTag(). The assignment `callingPackage = sessionInfo.getInstallerPackageName()` is removed. The commit also uses SessionInfo.INVALID_ID instead of the literal -1 and imports PackageInstaller.SessionInfo.
• Commit 942884abf148, InstallStart.java:getSourceInfo and isSystemDownloadsProvider: switch from getPackageManager() to the cached mPackageManager field, with no semantic change.

Completeness

• Covers the point in InstallStart.onCreate where the calling package name is obtained. getSourceInfo(callingPackage) now receives the getLaunchedFromPackage() value.
• Removes the path that substituted the session's installer package name for the calling package. The attribution tag is still read from the session.
• getSourceInfo keeps its @Nullable parameter and null handling. Since getLaunchedFromPackage() never returns null, that handling is harmless.
• The provided commits change only InstallStart.java (the legacy v1 flow). Per index search, the v2 flow (InstallRepository.kt) has its own getSourceInfo(callingPackage), but the material does not show how it obtains callingPackage. Coverage of that path cannot be judged.

Behavior changes

• callingPackage is never null and is taken from getLaunchedFromPackage(), the launcher record, instead of getCallingPackage().
• For session installs (ACTION_CONFIRM_INSTALL / ACTION_CONFIRM_PRE_APPROVAL), the source package is no longer taken from sessionInfo.getInstallerPackageName(). Only the installer attribution tag is read from the session.
• The session id sentinel changes from the literal -1 to SessionInfo.INVALID_ID. There is no functional difference if the constant equals -1.

Per major

• Android 14: same fix: two commits, 8575592802b9 (getLaunchedFromPackage) in android-security-14.0.0_r19 and 942884abf148 (removes the dead null-check branch) in android-security-14.0.0_r20. Patched region fully present (5/5) at android-security-14.0.0_r29.
• Android 15: not affected per the bulletin. Patched region present (5/5) at android-security-15.0.0_r17.
• Android 16: not affected per the bulletin. Patched region present (5/5) at android-security-16.0.0_r8.
• Android 17: not affected per the bulletin. Patched region present (5/5) at android-security-17.0.0_r1.

Unknowns

• The material does not show how getCallingPackage() could return a misleading value in this flow. The commit only references an internal document.
• The material does not show whether the v2 PackageInstaller flow (InstallRepository.kt) obtained callingPackage through the same API, or whether it was changed separately.
• The Android 13 fix commit is not included in the material.
• The later checks in InstallStart that use sourceInfo and the source uid are not shown in full.

Back to May 2025 · Findings