CVE-2025-32345 AI-generated analysis

platform/packages/apps/Settings, security settings (Content Protection toggle, src/com/android/settings/security/)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

In Settings, ContentProtectionTogglePreferenceController.updateState now disables the Content Protection main switch for every non-admin user (!UserManager.isAdminUser()) instead of only for guest users (UserManager.isGuestUser()).

Root cause

ContentProtectionTogglePreferenceController.updateState() decides whether the SettingsMainSwitchPreference for Content Protection can be used. When no enforced admin applies, the original code only called mSwitchBar.setEnabled(false) if userManager.isGuestUser() was true. Any other non-admin user (for example a secondary user) therefore kept an enabled switch and could change the Content Protection preference. The test file reads and writes this preference as a Settings.Global value (KEY_CONTENT_PROTECTION_PREFERENCE), which suggests it is a device-wide setting. The commit title states the toggle should not be enabled for non-admin users. The bulletin rates this as a High severity EoP.

How the fix works

• src/com/android/settings/security/ContentProtectionTogglePreferenceController.java:updateState: the condition `userManager != null && userManager.isGuestUser() && mSwitchBar != null` is changed to `userManager != null && !userManager.isAdminUser() && mSwitchBar != null`. mSwitchBar.setEnabled(false) is now applied to guests and to all other non-admin users. The enforced-admin branch before it (setDisabledByAdmin + return) is unchanged.
• tests/robotests/src/com/android/settings/security/ContentProtectionTogglePreferenceControllerTest.java: setUp switches from ShadowUserManager.setGuestUser(false) to setIsAdminUser(true). The guest test is renamed to updateState_flagEnabled_noEnforcedAdmin_nonAdminUser_switchBarDisabled and uses setIsAdminUser(false). The positive test is renamed to ..._adminUser_switchBarEnabled, explicitly sets setIsAdminUser(true) and verifies that setEnabled(false) is never called.

Completeness

• Covers the UI check in updateState for every non-admin user as reported by UserManager.isAdminUser(), replacing the narrower guest-only check.
• The fix is UI-level only: it disables the switch widget. onCheckedChanged() as shown has no admin check, and setChecked() and the availability logic are not in the material. The protection therefore relies on the switch being disabled, not on rejecting the write itself.
• The switch is only disabled when mSwitchBar != null, i.e. when displayPreference found a SettingsMainSwitchPreference for the key. This is unchanged from before.
• The material does not show whether the underlying Settings.Global write is also enforced elsewhere (for example in the framework).

Behavior changes

• For non-admin, non-guest users, the Content Protection main switch in Settings is now shown disabled when the enforced-admin branch does not apply. Before the fix, these users could use it.
• No change for admin users, guest users, or the enforced-admin (setDisabledByAdmin) path.

Per major

• Android 14: not affected: the bulletin does not list Android 14. ContentProtectionTogglePreferenceController.java and its test are absent at android-security-14.0.0_r29.
• Android 15: same fix: commit 6c9a5944dd04 in android-security-15.0.0_r10 (cherry-pick of ef801e1a8ec3, Change-Id I46609c795923d427a5b7fa10bc2e8b071fad72d6). At android-security-15.0.0_r17 the !isAdminUser() check is in place (6/8 lines of the patched region present).
• Android 16: same fix: commit dc41d27f1bd9 in android-security-16.0.0_r1 with an identical diff. At android-security-16.0.0_r8, 6/8 lines of the patched region are present.
• Android 17: not affected: the bulletin does not list Android 17. 7/8 lines of the patched region are present at android-security-17.0.0_r1.

Unknowns

• The material does not show the controller's setChecked()/isChecked()/getAvailabilityStatus() implementations, so it is unknown whether the Settings.Global write is enforced anywhere outside the UI.
• The material does not show whether non-admin users could reach the toggle other than through the Settings UI (for example via slices, since getSliceHighlightMenuRes is present).
• The material does not show whether the ShadowUserManager on every target branch provides setIsAdminUser(...).

Back to September 2025 · Findings