CVE-2026-0025 AI-generated analysis

platform/frameworks/base, core/java/android/app/Notification.java (MessagingStyle extras parsing, Notification.visitUris URI checking)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (6 corrections). Verify against the commit before relying on it.

Notification.java now reads EXTRA_MESSAGES and EXTRA_HISTORIC_MESSAGES with getParcelableArrayFromBundle(..., Bundle.class) instead of extras.getParcelableArray(..., Parcelable.class), so the element type is restricted to Bundle and arbitrary Parcelable element types are no longer accepted.

Root cause

Notification.visitUris(), Notification.hasImage() and the MessagingStyle code that restores messages from extras read EXTRA_MESSAGES and EXTRA_HISTORIC_MESSAGES with extras.getParcelableArray(key, Parcelable.class). That call returns a Parcelable[] whose elements can be any Parcelable type. These arrays were then passed to MessagingStyle.Message.getMessagesFromBundleArray(), which by its name expects Bundle elements (its body is not shown). A caller-controlled array with a non-Bundle element was not rejected when it was read. The test inserts a crafted Parcelable, MyParceledListSlice, into EXTRA_MESSAGES. Per the test comment ("to avoid visitUri check uris in EXTRA_MESSAGES value"), this could let a notification carrying content URIs in its messages get past the visitUris-based URI permission check during enqueue, without checkGrantUriPermission being applied to those URIs. The bulletin type is information disclosure.

How the fix works

• core/java/android/app/Notification.java:visitUris(): EXTRA_MESSAGES is now read as `Bundle[] messages = getParcelableArrayFromBundle(extras, EXTRA_MESSAGES, Bundle.class)`. EXTRA_HISTORIC_MESSAGES is read with the same helper and Bundle.class. Its local variable keeps the Parcelable[] type. The new test expects a non-Bundle element to produce java.lang.ArrayStoreException from enqueueNotificationWithTag, with no URI grant check for the embedded URI.
• core/java/android/app/Notification.java:hasImage(): EXTRA_MESSAGES is read with getParcelableArrayFromBundle(extras, EXTRA_MESSAGES, Bundle.class) into a Bundle[] before getMessagesFromBundleArray() is called.
• core/java/android/app/Notification.java, MessagingStyle code that restores from extras (enclosing method name not shown in the hunk): EXTRA_MESSAGES and EXTRA_HISTORIC_MESSAGES are both read with getParcelableArrayFromBundle(..., Bundle.class) into Bundle[] before Message.getMessagesFromBundleArray() is called.
• services/tests/uiservicestests/.../NotificationManagerServiceTest.java: adds testNoUriGrantsForBadMessagesList. The test builds a MessagingStyle notification that references content://com.android.contacts/display_photo/1, appends a crafted non-Bundle Parcelable to EXTRA_MESSAGES, and enqueues the notification through the binder service. It expects an ArrayStoreException and no checkGrantUriPermission call for that URI.

Completeness

• The fix covers the EXTRA_MESSAGES/EXTRA_HISTORIC_MESSAGES reads in Notification.java that appear in the diff: visitUris (both keys), hasImage (EXTRA_MESSAGES) and the MessagingStyle restore code (both keys).
• MessagingStyle.Message.getMessagesFromBundleArray() itself is not changed, so the fix depends on callers passing a type-checked array. A caller of getMessagesFromBundleArray that still passes a Parcelable[] read with Parcelable.class would not be covered. The material shows no such caller.
• Readers of these extras outside Notification.java (for example SystemUI or support-library code) are not part of this change and are not shown in the material.
• In all three diffs, the new test method testNoUriGrantsForBadMessagesList has no @Test annotation, while the neighbouring tests do. The material does not show whether the test actually runs.

Behavior changes

• When an EXTRA_MESSAGES or EXTRA_HISTORIC_MESSAGES array contains a non-Bundle Parcelable, enqueueNotificationWithTag now fails for that notification (the test expects ArrayStoreException) instead of accepting it.
• Well-formed MessagingStyle notifications built with Message.toBundle() arrays are expected to be unaffected.

Per major

• Android 14: Same fix: commit 5e1623a880d2 in android-security-14.0.0_r25 changes visitUris, hasImage and the MessagingStyle restore code. At android-security-14.0.0_r29, 6 of 8 patched-region lines are present, and the visible visitUris code is the fixed version.
• Android 15: Same fix: commit 5ffc92d00244 in android-security-15.0.0_r13 has the same Notification.java hunks at shifted line numbers. Its test diff also adds static imports (EXTRA_MESSAGES, EXTRA_MESSAGING_PERSON, FLAG_UPDATE_CURRENT) and updates further test references. At android-security-15.0.0_r17, 6 of 8 patched-region lines are present.
• Android 16: Same fix: commit 014dea279c49 in android-security-16.0.0_r4 has the same Notification.java hunks. At android-security-16.0.0_r8, 6 of 8 patched-region lines are present.
• Android 17: Not affected per the bulletin (Android 17 is not listed). At android-security-17.0.0_r1, 6 of 8 patched-region lines are present.

Unknowns

• How MessagingStyle.Message.getMessagesFromBundleArray() behaved on a non-Bundle element before the fix (its body is not shown), and so exactly how the URI check was skipped.
• The body and visibility of getParcelableArrayFromBundle.
• The name of the enclosing MessagingStyle method in the third hunk.
• Where the leaked URI content is finally rendered or granted (for example by SystemUI).
• Which 2 of the 8 patched-region lines differ at the latest security tags.
• Whether readers of EXTRA_MESSAGES outside Notification.java exist and apply equivalent type checks.

Back to March 2026 · Findings