CVE-2025-48551 AI-generated analysis
platform/packages/modules/IntentResolver, Sharesheet (ChooserActivity / ChooserActionFactory edit-image action)
The Sharesheet "edit image" action in IntentResolver's ChooserActivity is now launched as the user that launched the sharesheet instead of always as the personal profile user.
Root cause
In ChooserActivity.createChooserActionFactory(), the anonymous ChooserActionFactory.ActionActivityStarter used by the image-editor action called safelyStartActivityAsUser(targetInfo, getPersonalProfileUserHandle()), and the shared-element variant did the same. The interface methods were named safelyStartActivityAsPersonalProfileUser / ...WithSharedElementTransition, and the call site in ChooserActionFactory carries the comment "Action bar is user-independent; always start as primary." As a result, when the sharesheet ran in a non-personal user or profile, the edit target was started in the personal profile rather than in the user that launched the sharesheet. The bulletin rates this as an information disclosure (ID) issue.
How the fix works
- ChooserActivity.java:createChooserActionFactory(): the ActionActivityStarter implementation now calls safelyStartActivityAsUser(targetInfo, UserHandle.of(UserHandle.myUserId())) in both the plain and the shared-element-transition variants. The editor target is therefore started as the user the ChooserActivity itself runs as, not as getPersonalProfileUserHandle().
- ChooserActionFactory.java:ActionActivityStarter: the interface methods are renamed from safelyStartActivityAsPersonalProfileUser / safelyStartActivityAsPersonalProfileUserWithSharedElementTransition to safelyStartActivityAsLaunchingUser / safelyStartActivityAsLaunchingUserWithSharedElementTransition. The default implementation of the shared-element method delegates to the renamed method.
- ChooserActionFactory.java (edit action lambda, around the firstImageView check): the two call sites are updated to the renamed methods. There is no logic change there.
- Per the commit message, this change covers the case where the use_preferred_image_editor flag is off or does not exist. The flag-on case was fixed separately in ag/34038177, which is not included in this material.
Completeness
- Covers both launch paths of the edit action (with and without the shared element transition) in ChooserActivity's ActionActivityStarter.
- Only the ActionActivityStarter used for the image-editor action is changed. The commit explicitly addresses the flag-off / flag-absent path. The separate flag-on fix (ag/34038177) is not shown here, so on branches where use_preferred_image_editor exists, that other change is also required.
- The stale comment "Action bar is user-independent; always start as primary." remains in ChooserActionFactory, and the Log.d string in the Android 15/16 versions still says safelyStartActivityAsPersonalProfileUser. Both are cosmetic only.
- Any other ActionActivityStarter implementations (e.g. in tests) must be updated for the rename. None are shown in the material.
Behavior changes
- The image editor is now launched in the user/profile that launched the sharesheet (UserHandle.myUserId() on 14, mUserInteractor.getLaunchedAs() on 15/16) instead of in the personal profile.
- Public interface method names in ChooserActionFactory.ActionActivityStarter changed (a source-incompatible rename within the module).
Per major
- Android 14: same fix (75f41ba2e89d in android-security-14.0.0_r22): uses UserHandle.of(UserHandle.myUserId()) in place of getPersonalProfileUserHandle(). The fixed code is visible at android-security-14.0.0_r29.
- Android 15: adapted fix (13c30b464d04 in android-security-15.0.0_r10): same rename. The launch user changes from mProfiles.getPersonalHandle() to mUserInteractor.getLaunchedAs(). The surrounding edit-lambda condition (requireFullVisibility/isFullyVisible) was already there before the fix.
- Android 16: adapted fix (9810de0fcb5a in android-security-16.0.0_r1): same approach as 15, using mUserInteractor.getLaunchedAs() in place of mProfiles.getPersonalHandle().
- Android 17: not affected (not listed by the bulletin). 6/8 lines of the patched region are present at android-security-17.0.0_r1.
Unknowns
- The content of the companion fix for the use_preferred_image_editor flag-on path (ag/34038177), and whether that flag exists on Android 14.
- Exactly what information is disclosed and the concrete trigger scenario. The bulletin only gives type ID and severity High.
- Whether the edit intent carries URI permission grant flags, and where the editor component is sourced from. Neither is shown in the material.
- Whether the 2 lines of the patched region missing from later tags reflect refactoring or a partial state. The r29 context shows the fixed launch calls present.