CVE-2025-48563 AI-generated analysis

platform/frameworks/base, autofill system service (services/autofill, RemoteFillService)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

Adds an onNullBinding() override to RemoteFillService that calls unbind(), so system_server no longer stays bound, with BIND_ALLOW_BACKGROUND_ACTIVITY_STARTS, to an autofill service whose onBind() returned null.

Root cause

RemoteFillService (a ServiceConnector.Impl<IAutoFillService>) binds the autofill service component with Context.BIND_ALLOW_BACKGROUND_ACTIVITY_STARTS, plus BIND_ALLOW_INSTANT when allowed, as its constructor shows. It implemented onServiceConnectionStatusChanged but did not override ServiceConnection.onNullBinding(). The commit message says that an autofill service returning null from onBind() therefore stayed bound by system_server and could launch activities from the background.

How the fix works

• services/autofill/java/com/android/server/autofill/RemoteFillService.java: adds `public void onNullBinding(@NonNull ComponentName name)`, which overrides the ServiceConnection callback. It logs "onNullBinding" when sVerbose is set and then calls unbind(), which drops the binding when the remote service returns a null binder.
• No other logic changes. The bind flags passed to super() in the constructor (BIND_ALLOW_BACKGROUND_ACTIVITY_STARTS, optional BIND_ALLOW_INSTANT) stay the same.

Completeness

• Covers the null-binding case for the autofill fill-service connection in RemoteFillService.
• Only RemoteFillService.java is changed. The material does not show other ServiceConnector.Impl subclasses that bind with BIND_ALLOW_BACKGROUND_ACTIVITY_STARTS, so it is not visible whether they already handle onNullBinding.
• The fix depends on the platform delivering onNullBinding for a null onBind() result. It adds no other validation of the returned binder.

Behavior changes

• An autofill service that returns null from onBind() is now unbound by system_server when onNullBinding fires, instead of staying bound.
• A new verbose log line "onNullBinding" is written under TAG when sVerbose is enabled.
• Per the commit message, such a service can no longer launch activities from the background through this binding.

Per major

• Android 14: same fix: commit 1f704bff05f0 in android-security-14.0.0_r22, an 8-line addition of onNullBinding() in RemoteFillService.java; 2/2 lines present at android-security-14.0.0_r29.
• Android 15: same fix: commit a6a570a6f497 in android-security-15.0.0_r10, identical hunk at a different offset (line 116 vs 94); 2/2 lines present at android-security-15.0.0_r17.
• Android 16: same fix: commit dee86220f445 in android-security-16.0.0_r1, identical hunk (line 117); 2/2 lines present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin); the patched region (2/2 lines) is present at android-security-17.0.0_r1.

Unknowns

• The bulletin lists Android 13 as affected, but the material includes no Android 13 fix commit or tag.
• The ServiceConnector.Impl base class is not shown, so the exact behavior before the fix in the null-binding case (for example, whether the idle auto-disconnect timeout applied) is not visible.
• What triggers the bind of the autofill service is not shown.
• It is not shown whether other ServiceConnector-based connections that bind with BIND_ALLOW_BACKGROUND_ACTIVITY_STARTS lack an onNullBinding override.

Back to September 2025 · Findings