CVE-2025-26458 AI-generated analysis

platform/frameworks/base, services/core location (LocationProviderManager.LocationPendingIntentTransport)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Adds options.setPendingIntentBackgroundActivityLaunchAllowed(false) to the BroadcastOptions that LocationPendingIntentTransport in LocationProviderManager.java uses when system_server sends a client-supplied PendingIntent, so these sends explicitly deny background activity launch.

Root cause

LocationPendingIntentTransport in services/core/java/com/android/server/location/provider/LocationProviderManager.java sends the client's PendingIntent from system_server in two places: deliverOnLocationChanged via PendingIntentSender.send, and the provider-enabled delivery via mPendingIntent.send with KEY_PROVIDER_ENABLED. The BroadcastOptions built with BroadcastOptions.makeBasic() set setDontSendToRestrictedApps(true) and, for location results, a temporary app allowlist for foreground services. They did not explicitly set whether background activity launches are allowed for the PendingIntent send. The commit describes the fix as 'fixing the default values for pending intent'. The bulletin rates the issue as a High EoP.

How the fix works

• LocationProviderManager.java:LocationPendingIntentTransport.deliverOnLocationChanged: adds options.setPendingIntentBackgroundActivityLaunchAllowed(false) after options.setDontSendToRestrictedApps(true). This is before the temporary allowlist is set and before PendingIntentSender.send(mPendingIntent, mContext, intent, callback, options.toBundle()).
• LocationProviderManager.java:LocationPendingIntentTransport (provider-enabled delivery, second hunk at line ~316 in 14): adds the same options.setPendingIntentBackgroundActivityLaunchAllowed(false) before mPendingIntent.send(mContext, 0, new Intent().putExtra(KEY_PROVIDER_ENABLED, enabled), null, null, null, options.toBundle()).
• Net effect: both PendingIntent sends from this transport now explicitly carry the BAL-denied option. The foreground-service temporary allowlist for location results is unchanged.

Completeness

• Covers both PendingIntent send sites inside LocationPendingIntentTransport (location changed and provider enabled changed). No other code paths are modified.
• The fix changes send options only. It does not change who may register a PendingIntent and does not validate the PendingIntent itself.
• Other PendingIntent sends in location services or elsewhere in system_server are not shown in the material and are not touched by this commit. Whether they need the same option is unknown from the material.

Behavior changes

• PendingIntent sends for location updates and provider enabled/disabled changes now explicitly pass setPendingIntentBackgroundActivityLaunchAllowed(false). Background activity launches tied to these sends are expected to be denied, subject to the platform BAL policy.
• The foreground service start allowance for location PendingIntents (setTemporaryAppAllowlist with TEMPORARY_ALLOW_LIST_TYPE_FOREGROUND_SERVICE_ALLOWED) is preserved.

Per major

• Android 14: same fix: commit 9d2acb2d3c5d in android-security-14.0.0_r21 (cherry-pick of 225602a7d0fe); 8/8 lines of the patched region present at android-security-14.0.0_r29.
• Android 15: same fix: commit 937c2903736f in android-security-15.0.0_r9, identical two-line diff (hunks at lines 283/325); 8/8 lines present at android-security-15.0.0_r17.
• Android 16: same fix: original commit 225602a7d0fe in android-16.0.0_r2, identical diff (hunks at lines 285/327); 8/8 lines present at android-security-16.0.0_r8.
• Android 17: not affected per the bulletin (not listed); the patched region is present 8/8 at android-security-17.0.0_r1.

Unknowns

• The exact name of the second patched method. The hunk shows only its body sending KEY_PROVIDER_ENABLED, and the r29 code context ends before it.
• How Android 13 was fixed. The bulletin lists 13 as affected, but the material has no Android 13 commit and does not show whether the API is available there.
• The actual default BAL behaviour for a PendingIntent sent by system_server without this option.
• Whether other PendingIntent send sites in location services lack the same option.

Back to June 2025 · Findings