CVE-2025-48589 AI-generated analysis

platform/frameworks/base, SystemUI quick settings privacy indicator (packages/SystemUI/src/com/android/systemui/qs/HeaderPrivacyIconsController.kt)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

SystemUI's HeaderPrivacyIconsController now filters the PermissionGroupUsage list it sends to Safety Center (ACTION_VIEW_SAFETY_CENTER_QS, EXTRA_PERMISSION_USAGES). Only usages belonging to the current user and its profiles, plus phone-call usages, are included. Before the fix, the unfiltered list from PermissionManager.getIndicatorAppOpUsageData() was sent.

Root cause

In HeaderPrivacyIconsController.kt, permGroupUsage() returned permissionManager.getIndicatorAppOpUsageData(appOpsController.isMicMuted) unchanged. showSafetyCenter() then put that whole list into the ACTION_VIEW_SAFETY_CENTER_QS intent as EXTRA_PERMISSION_USAGES. Nothing compared UserHandle.getUserId(usage.uid) with the current user's profiles. As the commit message and the added tests imply, usages belonging to users outside the current profile group could therefore be sent to Safety Center when the mic/camera indicator was clicked.

How the fix works

• packages/SystemUI/src/com/android/systemui/qs/HeaderPrivacyIconsController.kt: the constructor gains an injected `userTracker: UserTracker` parameter (com.android.systemui.settings.UserTracker).
• HeaderPrivacyIconsController.permGroupUsage(): builds an ArrayList from permissionManager.getIndicatorAppOpUsageData(appOpsController.isMicMuted) and reads userTracker.userProfiles once. For each usage it computes UserHandle.getUserId(usage.uid). A usage is kept if usage.isPhoneCall is true or its userId matches the id of any entry in userProfiles. Otherwise it goes into invalidUserUsages, which is removed with usages.removeAll(invalidUserUsages). The return type changes from List to ArrayList, and the function changes from private to public (the new tests call it).
• HeaderPrivacyIconsController.showSafetyCenter(): uses the filtered ArrayList directly (`val usage = permGroupUsage()`) both for privacyLogger.logUnfilteredPermGroupUsage(usage) and for the EXTRA_PERMISSION_USAGES extra.
• packages/SystemUI/tests/src/com/android/systemui/qs/HeaderPrivacyIconsControllerTest.kt: adds a mocked UserTracker to the constructor call and three tests: testPermGroupUsage_filtersOutInactiveUsers, testPermGroupUsage_alwaysReturnPhoneCallUsage and testPermGroupUsage_returnsProfileUsages.

Completeness

• Filtering is applied in permGroupUsage(), before showSafetyCenter() sends the data out of SystemUI. Per index search, no other callers of showSafetyCenter() or the constructor were found, but that search may be incomplete.
• Phone-call usages (usage.isPhoneCall) are deliberately exempt from the user filter and are forwarded whichever user owns them. testPermGroupUsage_alwaysReturnPhoneCallUsage asserts this.
• The filter uses userTracker.userProfiles as read when permGroupUsage() runs. The diff adds no handling for a user switch that happens after that read.
• The PermissionManager.getIndicatorAppOpUsageData() API itself is not changed. The fix only filters on the consumer side, in SystemUI.
• privacyLogger.logUnfilteredPermGroupUsage() now receives the filtered list, so its name no longer matches its input.

Behavior changes

• Safety Center launched from the QS header privacy chip now receives only usages for the current user and its profiles, plus any phone-call usage. Usages of other users are no longer in EXTRA_PERMISSION_USAGES.
• The privacy log entry written by logUnfilteredPermGroupUsage now shows the filtered list.
• HeaderPrivacyIconsController requires an injected UserTracker. permGroupUsage() is now public and returns ArrayList<PermissionGroupUsage>.

Per major

• Android 14: Same fix: platform/frameworks/base ec11eca03974 in android-security-14.0.0_r24, a RESTRICT AUTOMERGE cherry-pick with Change-Id I4c7ec006c839f331cd8bd6b7ac366382cf2c2f4d. The constructor has no featureFlags parameter, and the tests are under packages/SystemUI/tests. 8/8 patched lines are present at android-security-14.0.0_r29.
• Android 15: Adapted fix: e086bd9b0fa8 in android-security-15.0.0_r12 (RESTRICT AUTOMERGE). The permGroupUsage()/showSafetyCenter() logic is identical. userTracker is added after the existing featureFlags constructor parameter, and the test's PermissionGroupUsage constructor call takes an extra trailing String argument. 8/8 lines are present at android-security-15.0.0_r17.
• Android 16: Adapted fix: 2aeba76a58c1 in android-security-16.0.0_r3. Same logic; userTracker is added after shadeDialogContextInteractor in the constructor, and the tests are in packages/SystemUI/multivalentTests. 8/8 lines are present at android-security-16.0.0_r8.
• Android 17: Not affected (the bulletin does not list Android 17). The patched region is present (8/8 lines) at android-security-17.0.0_r1.

Unknowns

• The exact condition that selects showSafetyCenter() over the privacy dialog path (not in the diff).
• Whether getIndicatorAppOpUsageData() returns usages for all users on the device or only some of them.
• Whether other SystemUI consumers of PermissionManager.getIndicatorAppOpUsageData() exist on these branches, and whether they filter by user.
• What Safety Center does with usages for other users on the receiving side (packages/modules/Permission code is not provided).

Back to December 2025 · Findings