CVE-2026-0070 AI-generated analysis

platform/frameworks/base, DevicePolicyManagerService (services/devicepolicy) plus core/res resources

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

DevicePolicyManagerService.setApplicationHidden() now refuses (returns false) to hide packages listed in a new framework resource array application_hidden_policy_exempt_apps (com.android.nfc, com.android.settings, com.android.providers.settings), because per the commit message hiding these critical apps in the work profile may cause failure to boot.

Root cause

setApplicationHidden() in DevicePolicyManagerService only skipped packages returned by listPolicyExemptAppsUnchecked(mContext). In AOSP the policy_exempt_apps array shown in policy_exempt_apps.xml is empty. Nothing in the shown guard prevented a device policy caller from hiding critical system packages such as com.android.nfc, com.android.settings or com.android.providers.settings. Per the commit message, hiding these in the work profile may cause failure to boot.

How the fix works

• core/res/res/values/policy_exempt_apps.xml: adds a new non-translatable string-array application_hidden_policy_exempt_apps containing com.android.nfc, com.android.settings and com.android.providers.settings. Its comment describes them as apps that will never be affected by DevicePolicyManager.setApplicationHidden.
• core/res/res/values/symbols.xml: registers <java-symbol type="array" name="application_hidden_policy_exempt_apps" /> so the array can be referenced as R.array.application_hidden_policy_exempt_apps.
• services/devicepolicy/java/com/android/server/devicepolicy/DevicePolicyManagerService.java: adds private isPackageExemptFromHiding(String packageName). It reads R.array.application_hidden_policy_exempt_apps from mContext.getResources() and returns true on an exact String.equals match.
• DevicePolicyManagerService.java:setApplicationHidden: the existing guard `if (exemptApps.contains(packageName))` becomes `if (exemptApps.contains(packageName) || isPackageExemptFromHiding(packageName))`. On a match it logs "setApplicationHidden(): ignoring %s as it's on policy-exempt list" and returns false.
• DevicePolicyManagerService.java:dumpResources: the new array is added to the dump output via dumpResources(pw, mContext, "application_hidden_policy_exempt_apps", R.array.application_hidden_policy_exempt_apps).

Completeness

• The new check is added only to setApplicationHidden. No other DevicePolicyManagerService entry point is changed in the diff.
• Protection is a static, exact-match list of three package names in AOSP. The dump lists it under "Other overlayable app resources", next to policy_exempt_apps and vendor_policy_exempt_apps.
• The added condition has no user-type check of its own. Whether the method filters by user elsewhere is not shown.
• The diff contains no migration or unhide step for packages that were already hidden before the update.

Behavior changes

• setApplicationHidden() now returns false and emits a Slogf.d log for com.android.nfc, com.android.settings and com.android.providers.settings instead of hiding them. This is the same return path used for policy-exempt apps.
• DevicePolicyManagerService dump output gains an application_hidden_policy_exempt_apps entry.
• A new framework resource symbol, application_hidden_policy_exempt_apps, is added.

Per major

• Android 14: same fix: commit 987b313aefa0 in android-security-14.0.0_r28. Same three-file change, with 8/8 patched lines present at android-security-14.0.0_r29.
• Android 15: same fix: commit 060fe5399350 in android-security-15.0.0_r16. Same changed lines; only offsets and surrounding context differ (the setApplicationHidden hunk context shows the enforcePermission call, and the symbols.xml context differs). 8/8 lines present at android-security-15.0.0_r17.
• Android 16: same fix: commit dc3785a739bc in android-security-16.0.0_r7. Same change, with 8/8 lines present at android-security-16.0.0_r8.
• Android 17: same fix: commit 4a97f5239d57 in android-17.0.0_r1 (base). Same change, with 8/8 lines present at android-security-17.0.0_r1.

Unknowns

• Why hiding these specific packages causes boot failure. Only the commit message statement is available.
• Whether critical packages hidden before the fix are restored on updated devices.
• The permission or ownership check on the Android 14 and 17 branches, which is outside the shown hunk context.
• What listPolicyExemptAppsUnchecked returns, and the contents of vendor_policy_exempt_apps.

Back to June 2026 · Findings