CVE-2026-28626 AI-generated analysis
platform/packages/apps/TV (LiveTv), SetupPassthroughActivity
Adds a launching-package identity check (getLaunchedFromPackage() on SDK 34+) to SetupPassthroughActivity so that the embedded setup Intent is only forwarded when the activity was launched by CommonConstants.BASE_PACKAGE; otherwise the activity finishes without forwarding.
Root cause
SetupPassthroughActivity takes a setup Intent from the incoming Intent's extras, copies the remaining extras into it (InputSetupActionUtils.removeSetupIntent(extras); setupIntent.putExtras(extras)) and then forwards it. The fix's log message ("Not forwarding intent") implies this forwarding. Before the fix, the only caller check visible in the shown context is a getCallingActivity() comparison against CommonConstants.BASE_PACKAGE. Google added a getLaunchedFromPackage() check ahead of it, which shows that the existing check was not considered enough to verify the launcher. The rest of that branch is not shown, so the exact pre-fix behaviour for an untrusted or null calling activity is not visible.
How the fix works
- src/com/android/tv/SetupPassthroughActivity.java: imports android.os.Build.
- src/com/android/tv/SetupPassthroughActivity.java (setup-intent forwarding block inside the try, immediately after setupIntent.putExtras(extras) and before the existing getCallingActivity() check): when Build.VERSION.SDK_INT >= 34, the fix calls getLaunchedFromPackage(). If the result is null or not equal to CommonConstants.BASE_PACKAGE, it logs a warning ("Calling package ... is not trusted. Not forwarding intent."), calls finish() and returns.
- The existing getCallingActivity()/BASE_PACKAGE check is kept unchanged. On SDK 34+ it now runs only after the launching-package check passes.
Completeness
- Covers the setup-intent forwarding path in SetupPassthroughActivity on SDK 34 or newer, which includes Android 14 through 17.
- The new check is wrapped in Build.VERSION.SDK_INT >= 34. On older SDK levels only the original getCallingActivity() check applies, so the new check adds no protection there.
- The check compares against the single package CommonConstants.BASE_PACKAGE. The value of that constant and the rest of the enclosing branch are not shown in the material.
- Only this one activity and code location are changed. The material does not show other TV app components that forward Intents taken from extras, so coverage beyond this path cannot be judged.
Behavior changes
- On SDK 34+, if SetupPassthroughActivity is launched by any package other than CommonConstants.BASE_PACKAGE, it now finishes without forwarding the embedded setup Intent and logs a Log.w warning that includes the calling package name.
- Launches where getLaunchedFromPackage() returns null are treated as untrusted and also finish.
- No behaviour change on SDK < 34.
Per major
- Android 14: same fix: commit 738d2cc1f03e in android-security-14.0.0_r29, identical diff (file 2a4a556f..87a66a0e), 8/8 lines of the patched region present.
- Android 15: same fix: commit f23429d7cad6 in android-security-15.0.0_r17, identical diff, 8/8 lines present.
- Android 16: same fix: commit 856a260c2504 in android-security-16.0.0_r8, identical diff, 8/8 lines present.
- Android 17: same fix: commit 25c98c910675 in android-security-17.0.0_r1, identical diff, 8/8 lines present.
Unknowns
- The rest of the existing getCallingActivity() branch and the code that actually starts setupIntent are not shown, so the precise pre-fix behaviour for a null or foreign calling activity is unknown.
- Why the getCallingActivity() check alone was insufficient is not explained in the material.
- The value of CommonConstants.BASE_PACKAGE and the manifest declaration (exported status, intent filters) of SetupPassthroughActivity are not in the material.
- The two internal Cherrypick-From commits referenced in the commit message are not available, so it is unknown whether they contain anything beyond this diff.