CVE-2026-0093 AI-generated analysis

platform/packages/apps/Settings, security / credential management consent UI (RequestManageCredentials, CredentialManagementAppAdapter)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (8 corrections). Verify against the commit before relying on it.

Replaces applicationInfo.loadLabel() with applicationInfo.loadSafeLabel(pm, DEFAULT_MAX_LABEL_SIZE_PX, SAFE_STRING_FLAG_TRIM | SAFE_STRING_FLAG_FIRST_LINE) at the three places where Settings renders the requesting app's name in the RequestManageCredentials UI, so an app-controlled label can no longer be used to hide from the user what permissions are requested.

Root cause

RequestManageCredentials and CredentialManagementAppAdapter inserted the requesting app's label into the title (R.string.request_manage_credentials_title via TextUtils.expandTemplate) and into an app-name view using ApplicationInfo.loadLabel(), with no limit on length, number of lines or whitespace. Per the commit message, this let the app developer hide from the user what permissions the app requests. The files import AppUriAuthenticationPolicy, which suggests that these permissions are app/URI authentication policy entries. That is an inference.

How the fix works

• src/com/android/settings/security/RequestManageCredentials.java (title population around line 251, in the try block that resolves the ApplicationInfo): applicationInfo.loadLabel(getPackageManager()) is replaced with applicationInfo.loadSafeLabel(getPackageManager(), DEFAULT_MAX_LABEL_SIZE_PX, SAFE_STRING_FLAG_TRIM | SAFE_STRING_FLAG_FIRST_LINE) before TextUtils.expandTemplate into request_manage_credentials_title. Static imports for PackageItemInfo.DEFAULT_MAX_LABEL_SIZE_PX and TextUtils.SAFE_STRING_FLAG_FIRST_LINE / SAFE_STRING_FLAG_TRIM are added.
• src/com/android/settings/security/CredentialManagementAppAdapter.java (mTitleView population around line 93): same loadLabel -> loadSafeLabel replacement with the same max size and flags, plus the same static imports.
• src/com/android/settings/security/CredentialManagementAppAdapter.java (mAppNameView population around line 156): String.valueOf(applicationInfo.loadLabel(mPackageManager)) becomes String.valueOf(applicationInfo.loadSafeLabel(mPackageManager, DEFAULT_MAX_LABEL_SIZE_PX, SAFE_STRING_FLAG_TRIM | SAFE_STRING_FLAG_FIRST_LINE)).
• Effect: with these flags the label is trimmed, reduced to its first line and limited to a bounded rendered width (general platform knowledge), which limits how much of the screen it can take up.

Completeness

• All three loadLabel() call sites shown in the diff for the two files are converted.
• The NameNotFoundException fallback paths are not changed. mAppNameView.setText(appName) remains. The diff is cut off before the argument passed to the title expandTemplate in the catch blocks.
• The fix only sanitizes the label text. It does not change the dialog layout or how the requested entries are presented. A SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS import is present in RequestManageCredentials.java and is unrelated to this change.
• No automated tests were added (Test: Manual per commit message).

Behavior changes

• Requesting-app labels shown in the RequestManageCredentials UI are now trimmed, limited to the first line and truncated to DEFAULT_MAX_LABEL_SIZE_PX, so long or multi-line labels render differently than before.
• The diff adds no new error paths.

Per major

• Android 14: same fix: commit 47f5449218e4 in android-security-14.0.0_r28 (cherry-pick, Change-Id Iefd92a41d84f5cfc3244dbd4a8f7f8d2a9105ad5); 7/8 lines of the patched region present at android-security-14.0.0_r29.
• Android 15: same fix: commit 7f9aa5805598 in android-security-15.0.0_r16; identical code hunks, with only the import context in RequestManageCredentials.java differing (blob 2c1b45219d0, where android.app.Activity follows the static imports); 7/8 lines present at android-security-15.0.0_r17.
• Android 16: same fix: commit 88ab2340c255 in android-security-16.0.0_r7; same hunks and RequestManageCredentials.java blob (2c1b45219d0) as Android 15; 7/8 lines present at android-security-16.0.0_r8.
• Android 17: same fix: commit 9cc2911dc24d in the android-17.0.0_r1 base; hunks identical to Android 14 (blobs 6a1d40aef7a -> 63d86b2e55c); 7/8 lines present at android-security-17.0.0_r1.

Unknowns

• The intent or entry point used to start RequestManageCredentials, and any restrictions on its callers, are not shown.
• What the title catch blocks pass to expandTemplate when the package is not found is not shown.
• Whether other Settings or framework UIs that show a requesting app's label in a credential or KeyChain context use loadLabel() is not shown.
• Why the per-major facts report 7/8 patched lines present is not explained by the material.

Back to June 2026 · Findings