CVE-2026-0060 AI-generated analysis

platform/packages/apps/Settings, Developer Options graphics driver (GraphicsDriverEnableAngleAsSystemDriverController)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (7 corrections). Verify against the commit before relying on it.

Gates the Developer Options "Enable ANGLE" switch in Settings behind a debug system property (debug.graphics.angle.developeroption.enable), keeps the switch usable when ANGLE is already active so it can be turned off, relabels the option as experimental, and rewrites the summary and reboot-dialog warnings (back up data; a failed restart needs a factory reset).

Root cause

In GraphicsDriverEnableAngleAsSystemDriverController.updateState, the "Enable ANGLE" SwitchPreference was left enabled on any device where ro.gfx.angle.supported equals "true"; its checked state reflects whether persist.graphics.egl is "angle". Per the reboot dialog string, changing the system OpenGL ES driver requires a reboot. The option had no additional guard, and the UI text ("Enable ANGLE") did not say the feature was experimental. The replacement strings state that if restarting fails after the change, a factory reset is needed to use the device.

How the fix works

• Commit 2097b24534af, src/com/android/settings/development/graphicsdriver/GraphicsDriverEnableAngleAsSystemDriverController.java: adds PROPERTY_DEBUG_ANGLE_DEVELOPER_OPTION = "debug.graphics.angle.developeroption.enable" and a private isAngleDeveloperOptionEnabled() that reads it via mSystemProperties.getBoolean(key, false). At the end of updateState() it calls mPreference.setEnabled(false) whenever the property is not true, regardless of ANGLE support state. It also adds a Log.v of the current persist.graphics.egl value next to where mShouldToggleSwitchBackOnRebootDialogDismiss is set to true.
• Commit 2097b24534af, GraphicsDriverSystemPropertiesWrapper.java: adds boolean getBoolean(String key, boolean def) to the wrapper interface. The Injector's anonymous implementation in the controller forwards to SystemProperties.getBoolean. Robolectric and JUnit tests are updated to set or mock the property to true so existing tests keep exercising the switch.
• Commit 2097b24534af, res/values/strings.xml: retitles enable_angle_as_system_driver to "Experimental: Enable ANGLE" and rewrites enable_angle_as_system_driver_summary as a warning about experimental status and camera/video app compatibility.
• Commit 468f22c59b52, GraphicsDriverEnableAngleAsSystemDriverController.updateState: relaxes the guard to `if (!isAngleDeveloperOptionEnabled() && !((SwitchPreference) mPreference).isChecked()) mPreference.setEnabled(false);`. When persist.graphics.egl is already "angle", the switch stays enabled and can be turned off without setting the debug property (which, per the commit message, resets on reboot). When ANGLE is off and the property is unset, the switch stays disabled. Adds JUnit test updateState_DeveloperOptionPropertyIsFalse covering both states.
• Commit 72801bd6f244, res/values/strings.xml: rewrites an intermediate version of enable_angle_as_system_driver_summary and reboot_dialog_enable_angle_as_system_driver. The summary now tells the user to back up important data; the dialog says that if restarting fails, a factory reset will be needed to use the device.

Completeness

• The guard is applied only to the preference's enabled state in updateState(). No change to the code path that actually sets persist.graphics.egl appears in these diffs, so protection relies on the preference being disabled in the UI.
• The debug property check defaults to false, so on a stock device the switch is disabled unless the property is set (for example with adb setprop). Per commit 468f22c59b52's message, the debug property does not persist across reboot.
• Commit 468f22c59b52 deliberately leaves the switch enabled when ANGLE is already the active driver, so it can be turned off. onDeveloperOptionsSwitchDisabled still resets persist.graphics.egl via toggleAngleAsSystemDriver(false) when developer options are turned off.
• Commit 72801bd6f244 changes only strings and has no functional effect.

Behavior changes

• The "Enable ANGLE" developer option is greyed out by default unless debug.graphics.angle.developeroption.enable is true or ANGLE is already active (persist.graphics.egl == "angle" on an ANGLE-supported device).
• The title changes to "Experimental: Enable ANGLE". The summary and reboot dialog now warn to back up data and say that a failed restart requires a factory reset.
• New verbose log line "Value of persist.graphics.egl is: ..." under tag GraphicsEnableAngleCtrl.
• GraphicsDriverSystemPropertiesWrapper gains a getBoolean method; every implementation of the interface must provide it.

Per major

• Android 14: Same fix: three cherry-picks into android-security-14.0.0_r28 (2097b24534af debug-property guard and strings, 468f22c59b52 relaxed guard, 72801bd6f244 warning strings). An intermediate strings change (the backup and factory-reset wording seen in 72801bd6f244's pre-image) is not in the material. 5/8 lines of the patched region are present at android-security-14.0.0_r29.
• Android 15: Resolved by bug_id at android-security-15.0.0_r16 with 2b5834d47f28, a translations import of the intermediate backup and factory-reset warning wording; no Java change is in the shown diff. 6/8 lines of the patched region are present at android-security-15.0.0_r17. Whether the Java guard is present on this branch is not shown.
• Android 16: Resolved by bug_id at android-security-16.0.0_r7 with 32c6cb147d3e, the string-only "Update enable ANGLE warning message" change (same content as 72801bd6f244). Its pre-image already has the "Experimental: Enable ANGLE" title and the intermediate backup-warning summary. 6/8 lines are present at android-security-16.0.0_r8. The Java guard commits for this branch are not shown.
• Android 17: Resolved as base at android-17.0.0_r1 with 1c2cf9256912, a translations import of the intermediate backup and factory-reset wording only. 4/8 lines of the patched region are present at android-security-17.0.0_r1. Which Java commits are in this branch is not shown.

Unknowns

• The exact failure mode behind the bulletin's DoS rating is not described. The new strings only say that if restarting fails after the change, a factory reset is needed.
• Whether the Java guard commits (2097b24534af, 468f22c59b52) landed on the 15, 16 and 17 branches, and under which commit ids. Only string and translation commits are shown for those branches.
• Which commit introduced the intermediate backup and factory-reset strings that form 72801bd6f244's pre-image on Android 14.
• The enclosing method of the added Log.v call (the context shows only the mShouldToggleSwitchBackOnRebootDialogDismiss = true line).
• The content of onPreferenceChange, and whether any path other than this preference can set persist.graphics.egl to "angle".

Back to June 2026 · Findings