CVE-2026-0098 AI-generated analysis

platform/packages/apps/DocumentsUI, src/com/android/documentsui/base/Shared.java (calling package identification)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (3 corrections). Verify against the commit before relying on it.

DocumentsUI's Shared.getCallingPackageName now honors the EXTRA_PACKAGE_NAME calling-package override only when the caller's signature matches the platform (SYSTEM_UID) signature. Before, it honored it for any caller flagged as a system or updated system app.

Root cause

Shared.getCallingPackageName(Activity) lets the caller replace the value from Activity.getCallingPackage() with the Intent.EXTRA_PACKAGE_NAME string extra. Before the fix, the gate was isSystemApp(info) || isUpdatedSystemApp(info): the caller's ApplicationInfo had to have FLAG_SYSTEM or FLAG_UPDATED_SYSTEM_APP. So any system-flagged package, including one not signed with the platform key, could make DocumentsUI treat an arbitrary package name as the calling package. The commit message describes the fix as shifting trust from installation status to signatures. The bulletin rates the issue High EoP.

How the fix works

• Shared.java:getCallingPackageName: removes the private helpers isSystemApp(ApplicationInfo) and isUpdatedSystemApp(ApplicationInfo), and the condition based on FLAG_SYSTEM/FLAG_UPDATED_SYSTEM_APP.
• Shared.java:getCallingPackageName: the override now applies only if activity.getIntent() != null && isTrustedSystemSignature(activity.getPackageManager(), info.uid). Here info is the ApplicationInfo of activity.getCallingPackage(). The extra must still be non-null and non-empty.
• Shared.java:isTrustedSystemSignature(PackageManager pm, int callingUid) (new): returns pm.checkSignatures(callingUid, android.os.Process.SYSTEM_UID) == PackageManager.SIGNATURE_MATCH. Only callers whose signature matches UID 1000 may supply EXTRA_PACKAGE_NAME.
• Single commit touching one file; no other DocumentsUI code is changed.

Completeness

• Covers the single override point in Shared.getCallingPackageName. DocumentsUI still accepts the EXTRA_PACKAGE_NAME extra, but only from platform-signed callers.
• The check compares signatures against SYSTEM_UID and requires SIGNATURE_MATCH. System or updated system apps signed with a non-platform key are no longer trusted. The diff adds no allowlist or permission-based alternative.
• The NameNotFoundException path is unchanged: if the calling package cannot be resolved, the unmodified getCallingPackage() value is returned.
• The fix does not change how the returned package name is used elsewhere in DocumentsUI; those callers are not in the material.
• The commit says Test: manual; no automated test is added.

Behavior changes

• System or updated system apps (FLAG_SYSTEM / FLAG_UPDATED_SYSTEM_APP) that are not signed with the platform key can no longer override the calling package name via Intent.EXTRA_PACKAGE_NAME. For them, DocumentsUI uses Activity.getCallingPackage().
• New null guard: if activity.getIntent() is null, the override is skipped instead of dereferencing the intent.
• The gate no longer checks system-app flags. Platform-signed callers that lack FLAG_SYSTEM/FLAG_UPDATED_SYSTEM_APP can now use the override; platform-signed system apps keep it.

Per major

• Android 14: same fix: a712c9468e47 in android-security-14.0.0_r28, Shared.java 9f328be69..f691229ab. The code at android-security-14.0.0_r29 shows the patched logic (resolver: 4/8 patched-region lines present).
• Android 15: same fix: b05353f638a7 in android-security-15.0.0_r16, identical diff and blob hashes as 14. Resolver: 4/8 patched-region lines present at android-security-15.0.0_r17.
• Android 16: same fix: 0c8b7870ece9 in android-security-16.0.0_r7. Same hunk content at shifted line numbers (Shared.java bb8a39393..0a5648f01, hunks at lines 227/246/262). Resolver: 4/8 patched-region lines present at android-security-16.0.0_r8.
• Android 17: same fix: a08d1c7ea084 in android-17.0.0_r1 (base), identical diff to 14/15. The resolver reports 3/8 patched lines at android-security-17.0.0_r1; the reason is not shown in the material.

Unknowns

• Which DocumentsUI activities call Shared.getCallingPackageName and what the spoofed package name is used for. The material does not show these callers, so the concrete privilege gained is not shown beyond the bulletin's High EoP rating.
• How DocumentsUI activities are launched so that getCallingPackage() is non-null.
• Why the Android 17 security tag shows only 3/8 patched-region lines.
• Whether the 14 patch applies to the 16 base without conflicts.
• No regression test is included (Test: manual).

Back to June 2026 · Findings