CVE-2025-48580 AI-generated analysis

platform/frameworks/base, media framework (android.media.browse.MediaBrowser / android.service.media.MediaBrowserService)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

MediaBrowser no longer always binds to a MediaBrowserService with Context.BIND_INCLUDE_CAPABILITIES; the flag is dropped when the root hints contain the new hidden key BrowserRoot.EXTRA_EXCLUDE_CAPABILITIES or the existing key BrowserRoot.EXTRA_RECENT.

Root cause

In media/java/android/media/browse/MediaBrowser.java the bind made during connection was hard-coded as mContext.bindService(intent, mServiceConnection, Context.BIND_AUTO_CREATE | Context.BIND_INCLUDE_CAPABILITIES). BIND_INCLUDE_CAPABILITIES makes the bound service inherit the binding process's capabilities (general platform knowledge). Because the flag was always set, every MediaBrowser connection passed the client's capabilities to the targeted MediaBrowserService, and the client had no way to opt out. This included the one-off EXTRA_RECENT query of recent playback described in the commit message.

How the fix works

• media/java/android/service/media/MediaBrowserService.java, class MediaBrowserService.BrowserRoot: adds the @hide constant EXTRA_EXCLUDE_CAPABILITIES = "android.service.media.extra.EXCLUDE_CAPABILITIES". It is a root-hint key meaning the bind connection should not include capabilities. Its Javadoc states the key is assumed to be set whenever EXTRA_RECENT is used.
• media/java/android/media/browse/MediaBrowser.java, bindService call inside class MediaBrowser (the enclosing method is not shown in the hunk): the fixed flag set is replaced by a computed int, bindServiceFlags = Context.BIND_AUTO_CREATE. BIND_INCLUDE_CAPABILITIES is added only if mRootHints == null, or if mRootHints contains neither BrowserRoot.EXTRA_EXCLUDE_CAPABILITIES nor BrowserRoot.EXTRA_RECENT. The commit also adds the import android.service.media.MediaBrowserService.BrowserRoot.
• Net effect: connections using EXTRA_RECENT, and connections that explicitly carry EXTRA_EXCLUDE_CAPABILITIES, bind without capability propagation. All other connections behave as before.

Completeness

• Covers only the single bindService call in MediaBrowser.java. The fix is an opt-out: the default case (null root hints, or hints without either key) still binds with BIND_INCLUDE_CAPABILITIES.
• EXTRA_RECENT is the only existing hint that now disables capability propagation implicitly. The EXTRA_OFFLINE and EXTRA_SUGGESTED root hints, defined in the same BrowserRoot class, do not exclude capabilities.
• The check uses containsKey only and does not read the value stored under EXTRA_EXCLUDE_CAPABILITIES or EXTRA_RECENT. A key present with the value false still disables the flag.
• EXTRA_EXCLUDE_CAPABILITIES is @hide. The material does not show any platform client being updated to pass it, so clients that do not use EXTRA_RECENT are protected only if they adopt the key.
• Nothing changes on the MediaBrowserService side. The restriction is entirely client-side.

Behavior changes

• MediaBrowser connections whose root hints contain EXTRA_RECENT now bind with BIND_AUTO_CREATE only, so the MediaBrowserService reached that way no longer inherits the client's capabilities.
• The new hidden root-hint key BrowserRoot.EXTRA_EXCLUDE_CAPABILITIES lets a client explicitly ask for a bind without BIND_INCLUDE_CAPABILITIES.
• No new error paths or exceptions; the only change is how the bind flags are computed.

Per major

• Android 14: same fix: commit 874eaecb47b8 in android-security-14.0.0_r24 (manual cherry-pick of ag/33253388, Change-Id Idc9b428f2ff53cb490ee596da35d24e1e7fca681). All 8/8 patched lines are present at android-security-14.0.0_r29. The MediaBrowserService.java hunk lands near line 872.
• Android 15: same fix: commit 2588609ffab9 in android-security-15.0.0_r12, with the same diff content. The MediaBrowserService.java hunk sits near line 608 because the file layout differs. All 8/8 lines are present at android-security-15.0.0_r17.
• Android 16: same fix: commit eb19b27ed8ab in android-security-16.0.0_r3, with the same diff content as 15. All 8/8 lines are present at android-security-16.0.0_r8.
• Android 17: not affected (not listed by the bulletin); the patched region is present 8/8 at android-security-17.0.0_r1.

Unknowns

• Which client and which capabilities were involved in the reported issue (bug 393582077 is not included in the material).
• Whether companion changes adopting EXTRA_EXCLUDE_CAPABILITIES (for example in SystemUI or other MediaBrowser users) shipped in the same release.
• The exact enclosing method of the modified bindService call; the hunk header shows only the class MediaBrowser.
• How the target service component is chosen, and which services can be reached this way.

Back to December 2025 · Findings