CVE-2026-28593 AI-generated analysis
platform/packages/apps/TV (Live TV), settings side panel (com.android.tv.ui.sidepanel.SettingsFragment)
The Live TV app's "Send Feedback" settings action now builds an explicit intent targeting com.google.android.feedback/com.google.android.feedback.FeedbackActivity instead of an implicit Intent.ACTION_APP_ERROR intent, so the intent can no longer resolve to an arbitrary app that registers for that action.
Root cause
In src/com/android/tv/ui/sidepanel/SettingsFragment.java, the "Send Feedback" ActionItem.onSelected() created `new Intent(Intent.ACTION_APP_ERROR)` with no package or component set, then built an ApplicationErrorReport (packageName/processName set to the TV app's package, and time). Because the intent was implicit, any installed app declaring an intent filter for ACTION_APP_ERROR could be a resolution candidate, so a third-party app could be opened from this action instead of the intended feedback activity. The commit message says the change is "To avoid opening malicious apps".
How the fix works
- src/com/android/tv/ui/sidepanel/SettingsFragment.java: adds `import android.content.ComponentName` and two constants, FEEDBACK_PACKAGE = "com.google.android.feedback" and FEEDBACK_CLASS = "com.google.android.feedback.FeedbackActivity".
- src/com/android/tv/ui/sidepanel/SettingsFragment.java: in the settings_send_feedback ActionItem.onSelected(), replaces `new Intent(Intent.ACTION_APP_ERROR)` with `new Intent().setComponent(new ComponentName(FEEDBACK_PACKAGE, FEEDBACK_CLASS))`. The intent no longer has an action set. It is explicit, so resolution is pinned to that single component and other apps' intent filters are not consulted. The ApplicationErrorReport construction that follows is unchanged.
Completeness
- Covers the single implicit-intent site in SettingsFragment's "Send Feedback" action. The diff touches only that Intent construction.
- The rest of onSelected() is not shown in the material: how the report is attached, how the intent is started, and whether an ActivityNotFoundException is handled. So the code does not show whether launch failures are handled.
- No other intent-construction sites in the TV app are changed or shown in the material. The material does not show whether the app has other implicit intents.
- The fix hard-codes a Google-specific package and class instead of, for example, using setPackage or verifying the target's signature. On builds without that package the action cannot resolve.
Behavior changes
- "Send Feedback" now always targets com.google.android.feedback/com.google.android.feedback.FeedbackActivity. Apps that register for ACTION_APP_ERROR are no longer resolution candidates for this action.
- The intent no longer has ACTION_APP_ERROR set, only an explicit component.
- On devices where com.google.android.feedback (or that activity) is missing or not reachable by the TV app, the action will fail to resolve. The exact user-visible result depends on surrounding code that the diff does not show.
Per major
- Android 14: same fix: commit 2e9c27acedc2 in android-security-14.0.0_r29, identical diff (blob 762a190c -> 1ac5d81e). Patched region fully present (8/8 lines).
- Android 15: same fix: commit 7e516e62a48d in android-security-15.0.0_r17, identical diff. Patched region fully present (8/8 lines).
- Android 16: same fix: commit d688b27298d4 in android-security-16.0.0_r8, identical diff. Patched region fully present (8/8 lines).
- Android 17: same fix: commit 724154d5db03 in android-security-17.0.0_r1, identical diff. Patched region fully present (8/8 lines).
Unknowns
- The rest of onSelected() is not in the diff or context: which extras are attached (including whether the ApplicationErrorReport goes into the intent), how startActivity is called, and how errors are handled.
- Whether the TV app's manifest or other code contains more implicit intents for similar actions.
- Which ApplicationErrorReport fields beyond packageName/processName/time are populated.