CVE-2025-32347 AI-generated analysis

platform/packages/apps/Settings, biometrics enrollment (BiometricEnrollIntroduction, shared by the face and fingerprint enroll introduction screens)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

BiometricEnrollIntroduction now strips the MultiBiometricEnrollHelper extras (EXTRA_SKIP_PENDING_ENROLL, EXTRA_ENROLL_AFTER_FACE, EXTRA_ENROLL_AFTER_FINGERPRINT) from its launch intent in onStart() whenever the calling package is not Settings itself, so PendingIntent extras supplied by external packages are dropped during enrollment.

Root cause

Before the fix, BiometricEnrollIntroduction did not check who launched it before keeping the MultiBiometricEnrollHelper extras in its launch intent. These are EXTRA_ENROLL_AFTER_FACE and EXTRA_ENROLL_AFTER_FINGERPRINT, which the tests populate with PendingIntents, and EXTRA_SKIP_PENDING_ENROLL. These extras were removed only in specific flows (removeEnrollNextBiometric / removeEnrollNextBiometricIfSkipEnroll), so a package other than Settings could launch the introduction activity with them still in the intent. The helper methods removeEnrollNextBiometricIfSkipEnroll and handleBiometricResultSkipOrFinished were also protected. The material does not show how the extras are used afterwards.

How the fix works

• src/com/android/settings/biometrics/BiometricEnrollIntroduction.java:onStart (new override): after super.onStart(), it checks whether getPackageName() equals getCallingPackage(). If not, including when getCallingPackage() returns null, it loops over List.of(MultiBiometricEnrollHelper.EXTRA_SKIP_PENDING_ENROLL, EXTRA_ENROLL_AFTER_FACE, EXTRA_ENROLL_AFTER_FINGERPRINT) and calls getIntent().removeExtra(key) on each.
• src/com/android/settings/biometrics/BiometricEnrollIntroduction.java: removeEnrollNextBiometricIfSkipEnroll and handleBiometricResultSkipOrFinished changed from protected to private.
• Adds import java.util.List. The Android 15 and 16 commits also add Robolectric tests named drops_pendingIntents to FaceEnrollIntroductionTest and FingerprintEnrollIntroductionTest, plus the helper newExternalPendingIntent. The tests assert that the three extras are absent after start. The Android 14 commit changes only BiometricEnrollIntroduction.java (1 file).

Completeness

• The check lives in the shared base class BiometricEnrollIntroduction, and the tests cover both the face and fingerprint introduction activities.
• Only the three listed extras are dropped. Other extras in the launch intent are not filtered by this change.
• The filter runs in onStart(). The material does not show whether any of these extras are already used in onCreate(), before onStart() runs.
• The trust decision rests only on getCallingPackage() matching Settings' own package name. It does not check who created the PendingIntent.
• Other enrollment activities that might read MultiBiometricEnrollHelper extras are not changed by this commit. The material does not show whether they read them.

Behavior changes

• When the enroll introduction activity is started by a package other than Settings, or with no calling package (getCallingPackage() == null), the EXTRA_SKIP_PENDING_ENROLL, EXTRA_ENROLL_AFTER_FACE and EXTRA_ENROLL_AFTER_FINGERPRINT extras are silently removed from the intent in onStart. Any behaviour driven by these extras is therefore unavailable for such launches.
• removeEnrollNextBiometricIfSkipEnroll and handleBiometricResultSkipOrFinished are now private. Subclasses that override or call them will no longer compile.

Per major

• Android 14: same fix: commit 214b82f7097b in android-security-14.0.0_r22, source change only (no test files). At android-security-14.0.0_r29, 7/8 lines of the patched region are present.
• Android 15: same fix plus tests: commit 25cfacbe5ac2 in android-security-15.0.0_r10. Same onStart logic at different line offsets, plus additions to FaceEnrollIntroductionTest and FingerprintEnrollIntroductionTest. At android-security-15.0.0_r17, 7/8 lines of the patched region are present.
• Android 16: same fix plus tests: commit d50de07930ee in android-security-16.0.0_r1, same logic and tests. At android-security-16.0.0_r8, 7/8 lines of the patched region are present.
• Android 17: not affected (not listed by the bulletin). At android-security-17.0.0_r1, 7/8 lines of the patched region are present.

Unknowns

• Where the PendingIntent extras are used or sent (the consuming code is not in the material).
• Whether the face and fingerprint enroll introduction activities are exported or otherwise reachable by third-party apps, and under what permission.
• Whether any of the three extras are read in onCreate(), before the new onStart() filter runs.
• How MultiBiometricEnrollHelper launches the introduction activity, and so whether getCallingPackage() matches Settings for legitimate internal launches (relevant for forks that change the launch path).
• Which line of the patched region is missing at each latest tag (7/8 lines present).
• Status and commit for Android 13, which the bulletin lists as affected.

Back to September 2025 · Findings