CVE-2026-28582 AI-generated analysis

platform/packages/apps/Settings, password / device credential confirmation (ConfirmDeviceCredentialActivity)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

ConfirmDeviceCredentialActivity now finishes immediately when it receives KeyguardManager.ACTION_CONFIRM_REMOTE_DEVICE_CREDENTIAL through any component other than the activity-alias com.android.settings.ConfirmRemoteDeviceCredentialActivity, so the remote-validation flow can no longer be entered by targeting the underlying activity class directly.

Root cause

ConfirmDeviceCredentialActivity handles several intent actions in onCreate, including KeyguardManager.ACTION_CONFIRM_REMOTE_DEVICE_CREDENTIAL (the 'remoteValidation' path). Per the comment added by the fix, the remote-validation flow must go through the alias com.android.settings.ConfirmRemoteDeviceCredentialActivity 'to avoid bypassing permission checks'. Before the fix, the activity code never checked which component the intent was delivered to, so an intent with the remote-validation action delivered to a component other than the alias still entered the remote-validation path. The manifest that declares the alias and its permission is not part of the material.

How the fix works

• src/com/android/settings/password/ConfirmDeviceCredentialActivity.java: adds the constant CONFIRM_REMOTE_DEVICE_CREDENTIAL_ACTIVITY_ALIAS = "com.android.settings.ConfirmRemoteDeviceCredentialActivity".
• ConfirmDeviceCredentialActivity.onCreate: right after 'remoteValidation' is computed from intent.getAction() and before mTaskOverlay is set, if remoteValidation is true the fix reads intent.getComponent(). If that is null or its getClassName() is not the alias string, it logs 'Caller bypassing alias for action: ...' with Log.w, calls finish() and returns, so the rest of onCreate after that point does not run.
• The Android 15/16/17 commits also add tests/robotests/src/com/android/settings/password/ConfirmDeviceCredentialActivityTest.java. It has two tests: remote validation with the alias component does not finish, and with the base class component the activity reaches DESTROYED. They also extend ShadowLockPatternUtils with a getCredentialTypeForUser shadow. The Android 14 commit contains only the source change.

Completeness

• The check applies only when the action equals ACTION_CONFIRM_REMOTE_DEVICE_CREDENTIAL. This change does not touch the FRP action or the normal confirm-credential actions in the same onCreate.
• Only the class name of intent.getComponent() is compared, not the package.
• The check runs in onCreate after the 'remoteValidation' computation. Any code earlier in onCreate (not shown in the material) runs before the check.
• The alias name is hardcoded in Java and must match the activity-alias declared in the Settings manifest, which the material does not show.
• No other file is touched, and the material shows no similar unfixed pattern.

Behavior changes

• Intents with action ACTION_CONFIRM_REMOTE_DEVICE_CREDENTIAL that arrive at ConfirmDeviceCredentialActivity with a null component, or with a component whose class name is not com.android.settings.ConfirmRemoteDeviceCredentialActivity, now finish immediately and log a Log.w message.
• Intents delivered via the alias go through the same path as before.
• Test-only (15/16/17): the Robolectric test ConfirmDeviceCredentialActivityTest is added, and ShadowLockPatternUtils gains a getCredentialTypeForUser implementation.

Per major

• Android 14: Same fix, source change only (16 insertions in ConfirmDeviceCredentialActivity.java, no tests). Commit 4b69be85e55d, RESTRICT AUTOMERGE, in android-security-14.0.0_r29. Patched region fully present (7/7 lines).
• Android 15: Same fix, plus the new ConfirmDeviceCredentialActivityTest and the ShadowLockPatternUtils.getCredentialTypeForUser shadow. Commit 839f92783965, RESTRICT AUTOMERGE, in android-security-15.0.0_r17. Patched region fully present (8/8).
• Android 16: Same fix, plus the same test and shadow change. Commit 3ee7e15a126f, RESTRICT AUTOMERGE, in android-security-16.0.0_r8. Patched region fully present (8/8).
• Android 17: Same fix, plus the test and shadow change, without RESTRICT AUTOMERGE in the commit title. Commit 642944e4c4e6 in android-security-17.0.0_r1. Patched region fully present (8/8).

Unknowns

• The material does not include the Settings manifest entry for the ConfirmRemoteDeviceCredentialActivity alias or the permission it enforces.
• What information the remote-validation flow exposes when reached without the alias. The bulletin only classifies it as ID, High.
• The part of onCreate that runs before the new check is not shown.
• Whether ConfirmDeviceCredentialActivity or InternalActivity are exported in the affected branches.
• Whether comparing only the class name, without the package, is enough in every case.

Back to September 2026 · Findings