CVE-2025-26437 AI-generated analysis
platform/frameworks/base, services/credentials (CredentialManagerService, Credential Manager system service)
Adds a caller identity check to the CredentialManagerService binder entry point that creates a GetCandidateRequestSession. Only the package configured as the device's credential autofill service (R.string.config_defaultCredentialManagerAutofillService) can invoke it; all other callers get a SecurityException.
Root cause
In services/credentials/java/com/android/server/credentials/CredentialManagerService.java, the ICredentialManager method that builds a GetCandidateRequestSession read userId and callingUid but did not check who the caller was before starting the session. The commit title says this API is meant for the credential autofill service. The bulletin classifies the issue as information disclosure (ID).
How the fix works
- CredentialManagerService.java, in the binder method that constructs GetCandidateRequestSession (the method name is not in the hunk): after callingUid is computed, the fix reads R.string.config_defaultCredentialManagerAutofillService and parses it with ComponentName.unflattenFromString. If the result is null, it throws SecurityException ("Credential Autofill service does not exist on this device.").
- It gets a PackageManager for the caller's user via mContext.createContextAsUser(UserHandle.getUserHandleForUid(callingUid), 0) and resolves pm.getNameForUid(callingUid). If that returns null, it throws SecurityException ("Couldn't determine the identity of the caller.").
- It compares componentName.getPackageName() with the resolved caller package using Objects.equals. On a mismatch it throws SecurityException ("<pkg> is not the device's credential autofill package.").
- A try/catch converts Resources.NotFoundException into a SecurityException, so a missing config string fails closed.
- Android 16 follow-up b3d70aab1515 ("unflag cred autofill security fix") removes the Flags.safeguardCandidateCredentialsApiCaller() gate and the android.credentials.flags.Flags import, so the check runs unconditionally. The Android 15 cherry-pick c623bbe68308 already carries the check without any flag.
Completeness
- The check is added only to the one binder method shown (the GetCandidateRequestSession path). This commit touches no other ICredentialManager methods. The material does not show whether sibling methods already had adequate checks.
- Every error branch fails closed: a config string that is missing or cannot be parsed, and a caller UID that cannot be resolved, all throw SecurityException.
- Identity is checked by matching the caller's package name (from PackageManager.getNameForUid for the caller's user) against the configured component's package. The component's class name is not compared, and no signature or privileged-app check is added.
- On Android 16 the check was first behind Flags.safeguardCandidateCredentialsApiCaller(). It became unconditional only with b3d70aab1515 in android-16.0.0_r2.
Behavior changes
- Callers of this API that are not the package named in config_defaultCredentialManagerAutofillService now get a SecurityException instead of a session.
- If config_defaultCredentialManagerAutofillService is missing or not a valid flattened ComponentName, this API now always throws SecurityException.
- Every call to this method now does a PackageManager lookup (createContextAsUser + getNameForUid).
Per major
- Android 14: Not affected (not listed by the bulletin). The per-major facts show 8/8 lines of the patched region present at android-security-14.0.0_r29; how they got there is not shown.
- Android 15: Same fix: c623bbe68308 in android-security-15.0.0_r9 (Change-Id I35f3cf616669a6879fd353876029152e3ce327f1), unflagged. 8/8 lines present at android-security-15.0.0_r17.
- Android 16: Adapted fix: the check was present behind Flags.safeguardCandidateCredentialsApiCaller(), and b3d70aab1515 in android-16.0.0_r2 removed the flag gate so it runs unconditionally. 8/8 lines present at android-security-16.0.0_r8.
- Android 17: Not affected (not listed by the bulletin). 8/8 lines of the patched region present at android-security-17.0.0_r1.
Unknowns
- The exact name of the patched binder method; the hunk shows only the class, so it is inferred from the GetCandidateRequestSession construction and the flag name.
- Whether any other permission check comes before the new code in the same method.
- Which callers could reach the method before the fix, what data the candidate session returns, and the precise disclosure impact beyond the bulletin's High/ID rating.
- How the patched region came to be present on Android 14 and 17 when the bulletin does not list them.