CVE-2025-48523 AI-generated analysis
platform/packages/apps/Contacts, vCard import (src/com/android/contacts/vcard/SelectAccountActivity.java)
Removes the branch in SelectAccountActivity.onCreate that silently returned the sole writable account as RESULT_OK. When one or more accounts exist, the account selection dialog is now always shown, so the vCard import flow no longer picks the account automatically.
Root cause
SelectAccountActivity.onCreate fetched the writable accounts with AccountTypeManager.blockForWritableAccounts(). When exactly one account existed, it immediately built a result Intent with ACCOUNT_NAME, ACCOUNT_TYPE and DATA_SET, called setResult(RESULT_OK, intent) and finish(), without showing any UI. On single-account devices the caller therefore received a selected account with no user interaction. The commit message says the security team recommended this change to prevent auto-importing when a single account exists (b/388032224).
How the fix works
- src/com/android/contacts/vcard/SelectAccountActivity.java:onCreate: deletes the `else if (accountList.size() == 1)` branch (9 lines) that auto-selected accountList.get(0), set RESULT_OK and finished.
- For any accountList.size() >= 1, control now falls through to the existing path. That path builds an AccountSelectionUtil.AccountSelectedListener over accountList and calls showDialog(R.string.import_from_vcf_file). The result Intent with RESULT_OK is only produced inside the listener's onClick, after the user selects an entry. A CancelListener that calls finish() is defined in the class; the shown context does not show how it is attached to the dialog.
- The size()==0 branch (logs 'Account does not exist' and calls finish()) is unchanged.
Completeness
- Covers only the single-account auto-selection in SelectAccountActivity.onCreate; this is the only code path changed.
- The zero-account path still finishes with no result and no dialog, unchanged by the fix.
- The comment at lines 57-60 of onCreate still says 'just one account -> use the account without asking the user', which no longer matches the code.
- The material does not show whether other entry points of the vCard import flow (for example callers that skip SelectAccountActivity) were reviewed; the diff touches only this activity.
Behavior changes
- On devices with exactly one writable account, the vCard import flow now shows the account selection dialog (resource R.string.import_from_vcf_file) with a single entry instead of returning the account automatically.
- The RESULT_OK account is only returned after the user selects the entry in the dialog.
- The log line 'The number of available accounts: 1' is now emitted for the single-account case.
Per major
- Android 14: same fix: commit 6104890ea916 in android-security-14.0.0_r22 (Change-Id I83f046c24d45e076aa783e5551b42dcbaacd0ad6). At android-security-14.0.0_r29, 7/8 lines of the patched region are present.
- Android 15: same fix: commit 7c8dbcffbc93 in android-security-15.0.0_r10, identical diff. At android-security-15.0.0_r17, 7/8 lines of the patched region are present.
- Android 16: same fix: commit c314edb9bde8 in android-security-16.0.0_r1, identical diff. At android-security-16.0.0_r8, 7/8 lines of the patched region are present.
- Android 17: not affected: the bulletin does not list it. At android-security-17.0.0_r1, 7/8 lines of the patched region are present.
Unknowns
- How an untrusted caller reaches the activity (exported attributes, intent filters, or the import activity that launches it) is not in the material.
- What the caller does with the RESULT_OK account (the actual import step) is not shown; the material only shows the account selection activity.
- Whether Android 13, which the bulletin lists as affected, received the same commit is not shown in the per-major facts.
- Which line of the patched region accounts for the 7/8 match in the latest tags is not stated.