CVE-2026-0088 AI-generated analysis

platform/packages/apps/CertInstaller, CertInstaller activity (CA certificate install dialogs)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (2 corrections). Verify against the commit before relying on it.

CertInstaller.getCallingAppLabel() now gets the calling app's label via ApplicationInfo.loadSafeLabel(pm) instead of loadLabel(pm), so the label shown in the CA certificate redirect dialog is sanitized before display.

Root cause

In src/com/android/certinstaller/CertInstaller.java, getCallingAppLabel() looked up the referrer package (mCredentials.getReferrer()) with PackageManager.getApplicationInfo(..., MATCH_DISABLED_COMPONENTS) and returned appInfo.loadLabel(pm). That is the raw application label, which the calling app controls. createRedirectCaCertificateDialog() formats this label into R.string.redirect_ca_certificate_with_app_info_message and sets it as the AlertDialog message. Per the commit message, a crafted label (for example one containing newlines) could push the CA certificate installation warning off-screen, so the user might not see the warning.

How the fix works

• src/com/android/certinstaller/CertInstaller.java:getCallingAppLabel(): the single return statement changes from appInfo.loadLabel(pm) to appInfo.loadSafeLabel(pm). The rest of the method (null referrer check, getApplicationInfo lookup, NameNotFoundException handling) is unchanged.
• loadSafeLabel on PackageItemInfo/ApplicationInfo runs the label through the framework's safe-for-presentation processing, which trims whitespace, keeps only the first line and bounds the label size (general platform knowledge). The commit message states the intent: have the system sanitize the label and strip characters such as newlines, so the dialog shows the app name without displacing the warning.
• The consumer, createRedirectCaCertificateDialog(), is not modified. It still builds the message with getString(R.string.redirect_ca_certificate_with_app_info_message, getCallingAppLabel()) and setMessage(message), but now receives the sanitized label.

Completeness

• Covers the label source used by getCallingAppLabel(). In the shown context, this is the only place where caller-controlled text goes into the redirect CA certificate dialog (createRedirectCaCertificateDialog()).
• getCallingAppLabel() is public. Because the sanitization happens at the source, any other caller inside CertInstaller also benefits. No other callers are shown in the material.
• The fix relies only on the framework's loadSafeLabel(pm) behavior. CertInstaller itself adds no extra length cap or layout hardening, such as a fixed message area or ellipsizing.
• Other dialogs in CertInstaller (e.g. createSelectCertificateUsageDialog(), SELECT_CERTIFICATE_USAGE_DIALOG) are untouched. The material does not show whether they display any caller-controlled text.

Behavior changes

• The calling app name shown in the CA certificate redirect dialog is now the system-sanitized label. Per the commit message, characters such as newlines are stripped, so apps with multi-line labels will see a changed name in the dialog.
• No change to control flow, error handling or return values, other than the content of the returned CharSequence.

Per major

• Android 14: same fix: commit d90ffd033f10 in android-security-14.0.0_r28, identical one-line diff (883c897..1eff53f). The android-security-14.0.0_r29 context shows loadSafeLabel(pm) at line 417.
• Android 15: same fix: commit d29fcd1eff25 in android-security-15.0.0_r16, identical diff to Android 14.
• Android 16: same fix: commit c935d8d07913 in android-security-16.0.0_r7, identical diff to Android 14.
• Android 17: same fix: commit 3dced430d0a9 in base release android-17.0.0_r1, identical diff. The patched region is present at android-security-17.0.0_r1.

Unknowns

• Whether getCallingAppLabel() has callers beyond createRedirectCaCertificateDialog(). Only that caller appears in the provided context.
• The material does not show the exact sanitization parameters loadSafeLabel(pm) applies in each release.
• The material does not show how the calling app reaches CertInstaller with a CA certificate (the intent path that fills in mCredentials and its referrer).

Back to June 2026 · Findings