CVE-2025-48629 AI-generated analysis
platform/frameworks/base, services/voiceinteraction (VoiceInteractionManagerService, default voice recognizer selection)
When the preferred recognizer package is not found, VoiceInteractionManagerService no longer falls back to the first available RecognitionService. It now auto-selects only a service whose application has ApplicationInfo.FLAG_SYSTEM, and returns null if there is none.
Root cause
In services/voiceinteraction/java/com/android/server/voiceinteraction/VoiceInteractionManagerService.java, the recognizer-selection logic tries to match a preferred package (prefPackage, which per the code comment is the current or default recognizer) among the available recognition services. If there was no match, the code unconditionally returned available.get(0), and only logged a warning when numAvailable > 1. Per the commit message, when no default is configured via config_systemSpeechRecognizer, this let any third-party app that declares a recognition service become the default recognizer automatically. There was no check that the app is a system app, and no user selection.
How the fix works
- VoiceInteractionManagerService.java (recognizer selection block; hunk at about line 852 on 14 and about line 933 on 15 and 16): the unconditional available.get(0) fallback is removed.
- A new loop goes through available.get(i).getServiceInfo() for i in [0, numAvailable). It skips any service where serviceInfo.applicationInfo.flags & ApplicationInfo.FLAG_SYSTEM is 0, and returns the first service with FLAG_SYSTEM set as new ComponentName(serviceInfo.packageName, serviceInfo.name).
- If no system-app service is found, the method logs 'no auto selectable voice recognition services found for user <userHandle>' and returns null instead of a ComponentName.
- The earlier 'more than one voice recognition service found, picking first' warning is removed.
Completeness
- The fix changes only the fallback path, taken when prefPackage is not matched among the available services. The path where prefPackage is found is not modified by the diff.
- The only trust check is FLAG_SYSTEM. If there are several system-app recognizers, the first one in the 'available' list is still picked without user input.
- The method can now return null in cases where it used to return a ComponentName (numAvailable > 0). The material does not show the callers, so the diff cannot confirm that every caller handles a null return.
Behavior changes
- On devices with no matching current or default recognizer and only third-party recognition services installed, no recognizer is auto-selected any more. The selection returns null and a warning is logged.
- When several recognizers exist and the preferred one is absent, a system-app recognizer is now chosen even if a third-party one comes earlier in the list.
- Log text changes: the 'more than one voice recognition service found, picking first' warning is removed, and a new 'no auto selectable voice recognition services found for user ...' warning is added.
Per major
- Android 14: same fix: platform/frameworks/base 6c030f1f30b4 in android-security-14.0.0_r24, hunk at about line 852 of VoiceInteractionManagerService.java.
- Android 15: same fix: platform/frameworks/base d8faf81970e4 in android-security-15.0.0_r12, identical hunk content at about line 933.
- Android 16: same fix: platform/frameworks/base 84dd2b90f4a2 in android-security-16.0.0_r3, identical hunk content at about line 933.
- Android 17: not affected (not listed by the bulletin). At android-security-17.0.0_r1, 1/4 lines of the patched region are present, the same value as at the fixed 14/15/16 tags.
Unknowns
- The material does not show the name of the enclosing method or how its callers use the return value, which can now be null.
- The material does not show how the 'available' list is ordered, so it is unclear which system recognizer is chosen when there are several.
- The material does not describe the concrete privilege a selected recognizer gains, beyond the bulletin's EoP/High rating.