CVE-2025-0076 AI-generated analysis
platform/frameworks/base, SystemUI Quick Access Wallet (packages/SystemUI qs/tiles and wallet/ui)
SystemUI's Quick Access Wallet tile and wallet screen now only load a WalletCard's card image and card icon when the Icon is TYPE_BITMAP or TYPE_ADAPTIVE_BITMAP; all other Icon types (URI, URI_ADAPTIVE_BITMAP, RESOURCE, DATA) produce a null drawable instead of being loaded in SystemUI's context.
Root cause
WalletCard objects returned by the bound QuickAccessWalletService carry Icon objects for the card image and the card icon, and SystemUI resolved them with Icon.loadDrawable(context) using its own context. In QuickAccessWalletTile.WalletCardRetriever.onWalletCardsRetrieved, the switch nulled only TYPE_URI and TYPE_URI_ADAPTIVE_BITMAP and still loaded TYPE_RESOURCE and TYPE_DATA. In WalletScreenController.QAWalletCardViewInfo, the card image was nulled only for Icon.TYPE_URI (TYPE_URI_ADAPTIVE_BITMAP, TYPE_RESOURCE and TYPE_DATA were loaded), and the card icon (getCardIcon) was loaded for every Icon type, including content URIs. The commit message states that the drawable should only be loaded from a bitmap.
How the fix works
- packages/SystemUI/src/com/android/systemui/qs/tiles/QuickAccessWalletTile.java : WalletCardRetriever.onWalletCardsRetrieved: the switch on mSelectedCard.getCardImage().getType() is reordered into an allow-list. TYPE_BITMAP and TYPE_ADAPTIVE_BITMAP call loadDrawable(mContext); TYPE_URI, TYPE_URI_ADAPTIVE_BITMAP, TYPE_RESOURCE and TYPE_DATA now all set mCardViewDrawable = null. The default branch is unchanged: it logs and sets null.
- packages/SystemUI/src/com/android/systemui/wallet/ui/WalletScreenController.java : QAWalletCardViewInfo constructor: the card image is loaded only if cardImageIcon.getType() is Icon.TYPE_BITMAP or Icon.TYPE_ADAPTIVE_BITMAP, otherwise mCardDrawable = null. Previously only TYPE_URI was excluded.
- packages/SystemUI/src/com/android/systemui/wallet/ui/WalletScreenController.java : QAWalletCardViewInfo constructor: the card icon from mWalletCard.getCardIcon() is now loaded only if it is non-null and of type TYPE_BITMAP or TYPE_ADAPTIVE_BITMAP, otherwise mIconDrawable = null. Previously it was loaded for any type.
- packages/SystemUI/src/com/android/systemui/wallet/ui/WalletView.java: adds a @VisibleForTesting getIcon() accessor for mIcon, used only by the new test; no behavior change.
- Tests: new multivalentTests QuickAccessWalletTileTest (testQueryCards_invalidDrawable_noSideViewDrawable uses a content:// Icon and asserts there is no sideViewCustomDrawable) and WalletScreenControllerTest.queryCards_hasCards_showCarousel_invalidIconSource_noIcon (content:// card image and card icon; asserts the header icon drawable is null).
Completeness
- Covers both SystemUI consumers of WalletCard images shown in the diff, the QS tile side-view drawable (card image) and the wallet screen's card image and card icon, with the same bitmap-only allow-list.
- Because the fix is an allow-list, any other or unknown Icon type is also rejected: the tile's default branch logs and sets null, and the controller's else branches set null.
- WalletView.getHeaderIcon consumes walletCard.getIcon() and is not changed itself. It is covered to the extent that QAWalletCardViewInfo.getIcon returns mIconDrawable, which the new test's null header icon assertion indicates.
- The material does not show how other Icon-bearing wallet objects are loaded in WalletScreenController or QuickAccessWalletController, for example the GetWalletCardsError icon or the tile icon from QuickAccessWalletClient.getTileIcon(). The tile's onWalletCardRetrievalError only sets the drawable to null and does not load the error icon.
- Per index search, the separate packages/apps/QuickAccessWallet plugin (WalletPanelViewController) also consumes WalletCard. Its drawable loading code is not in the material, so it cannot be determined here whether it needs an equivalent change.
Behavior changes
- QS Wallet tile: cards whose image Icon is TYPE_RESOURCE or TYPE_DATA no longer get a sideViewCustomDrawable (previously loaded); URI types remain null as before.
- Wallet screen: card images of type TYPE_URI_ADAPTIVE_BITMAP, TYPE_RESOURCE or TYPE_DATA now render with a null card drawable.
- Wallet screen: card icons (header icon) of any non-bitmap type are no longer displayed; mIconDrawable is null.
- No new error codes or exceptions appear in the diff. For a card whose image and icon are invalid, the new test asserts that the carousel is visible, the empty state and error view are gone, and the header icon is null.
Per major
- Android 14: same fix: platform/frameworks/base cac7c51cd276 in android-security-14.0.0_r18 (Change-Id I0033f6ba7ce7f9b9d592e7ce44e63ba804ceb348, cherry-picked from internal commits eb5a9b8a829d and 827947591b53); at android-security-14.0.0_r29, 8/8 lines of the patched region are present.
- Android 15: same fix: platform/frameworks/base d6ad7f34eaf5 in android-security-15.0.0_r6. The code change is identical; only line offsets differ (tile hunk at @@ -243, controller hunk at @@ -330). At android-security-15.0.0_r17, 8/8 lines are present.
- Android 16: not affected (not listed by the bulletin); the patched region is present (8/8 lines) at android-security-16.0.0_r8.
- Android 17: not affected (not listed by the bulletin); the patched region is present (8/8 lines) at android-security-17.0.0_r1.
Unknowns
- The exact disclosure mechanism (which URI or resource target was abused, and with whose privileges it is resolved) is not described in the material; the bulletin only rates it High / ID.
- Whether Android 13 (listed as affected by the bulletin) received the same commit is not shown in the per-major facts.
- How WalletScreenController handles the GetWalletCardsError icon, and whether QuickAccessWalletController or the tile icon path load Icons by other means, is not shown.
- Whether the packages/apps/QuickAccessWallet plugin loads WalletCard Icons of non-bitmap types is not shown.