CVE-2025-26435 AI-generated analysis

platform/packages/apps/Settings, security settings (ContentProtectionTogglePreferenceController)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

The Settings content protection toggle controller now disables its main switch bar when the current user is a guest user, so a guest can no longer flip the content protection switch from that screen.

Root cause

In src/com/android/settings/security/ContentProtectionTogglePreferenceController.java, the switch bar state logic only had an admin-enforcement branch: setDisabledByAdmin(mEnforcedAdmin), under a condition that includes mContentProtectionPolicy != CONTENT_PROTECTION_NOT_CONTROLLED_BY_POLICY. It never checked whether the current user is a guest, so the content protection switch stayed enabled for guest users.

How the fix works

• src/com/android/settings/security/ContentProtectionTogglePreferenceController.java, in the switch-bar state update path reached from updateState(): an explicit `return;` is added after the existing admin-enforcement branch, so the admin path exits before the new check.
• Same method: a new block gets UserManager via mContext.getSystemService(UserManager.class). If it is non-null, userManager.isGuestUser() is true and mSwitchBar is non-null, the block calls mSwitchBar.setEnabled(false).
• tests/robotests/.../ContentProtectionTogglePreferenceControllerTest.java: adds ShadowUserManager to the shadows config and resets guest state to false in setUp. It adds updateState_flagEnabled_noEnforcedAdmin_guestUser_switchBarDisabled and a non-guest counterpart, and asserts that setEnabled(false) is never called in the existing non-guest cases.

Completeness

• Covers only the UI enablement of the switch bar in this controller. The guest check runs only when mSwitchBar is non-null and UserManager can be obtained.
• The guest check is skipped when the admin branch returns early. In that case setDisabledByAdmin(mEnforcedAdmin) is called instead. The material does not show whether that always makes the switch non-operable.
• The diff does not change isChecked/setChecked or the underlying setting write path (the class imports ContentResolver, Settings and UserHandle). The material does not show whether a guest can change the setting through another path.
• Only the guest user type is restricted. This change considers no other user types or user restrictions.

Behavior changes

• For a guest user, the content protection main switch in Settings is shown disabled (setEnabled(false)) when the admin-enforcement branch was not taken.
• When the admin-enforcement branch is taken, the new return means the guest check does not run after setDisabledByAdmin.
• No change for non-guest users.

Per major

• Android 14: not affected: not listed by the bulletin. ContentProtectionTogglePreferenceController.java and its test are absent at android-security-14.0.0_r29.
• Android 15: same fix: commit 9dc0dd2c50ce in android-security-15.0.0_r8 (cherry-picked from baf503050fc6). 8/8 patched lines present at android-security-15.0.0_r17.
• Android 16: not affected: not listed by the bulletin. 8/8 patched lines present at android-security-16.0.0_r8.
• Android 17: not affected: not listed by the bulletin. 8/8 patched lines present at android-security-17.0.0_r1.

Unknowns

• The hunk header does not give the exact name of the patched method. The tests show it is reached via updateState().
• The full condition of the admin-enforcement branch is not shown.
• The material does not show what the toggle writes (which Settings key, which user) or the concrete consequence of a guest changing it.
• The material does not show whether other entry points (setChecked, onCheckedChanged, or other UIs) let a guest change the same setting.

Back to May 2025 · Findings