CVE-2026-28630 AI-generated analysis

platform/packages/apps/ContactsPicker, ContactsPickerActivity (system Contacts Picker UI)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

ContactsPickerActivity now calls window.setHideOverlayWindows(true) in onCreate, and the HIDE_OVERLAY_WINDOWS permission is added to the manifest, so that other apps' non-system overlay windows cannot be drawn over the Contacts Picker UI.

Root cause

ContactsPickerActivity.onCreate created its window without asking for non-system overlay windows to be hidden. Per the commit message, an app holding SYSTEM_ALERT_WINDOW could therefore draw over the picker, hide the privacy banner or show misleading content, and so mislead the user into granting the caller contact access without full disclosure.

How the fix works

• src/com/android/contactspicker/ContactsPickerActivity.kt:onCreate: right after super.onCreate(savedInstanceState), and before both the savedInstanceState != null (setupComposeUi) branch and routeIntent(intent), the fix adds window.setHideOverlayWindows(true). This sets SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS in the window's LayoutParams privateFlags (the new test asserts this), so non-system overlays are hidden while this window is shown.
• AndroidManifest.xml: adds <uses-permission android:name="android.permission.HIDE_OVERLAY_WINDOWS" />, which setHideOverlayWindows requires.
• tests/componenttests/.../ContactsPickerActivityTest.kt: adds onCreate_setsHideOverlayWindows, which launches the activity and asserts that attrs.privateFlags has WindowManager.LayoutParams.SYSTEM_FLAG_HIDE_NON_SYSTEM_OVERLAY_WINDOWS set.

Completeness

• The flag is set unconditionally at the top of onCreate, so it covers both a cold start (the routeIntent path) and activity recreation (the savedInstanceState != null path). Because the activity is singleTop, onNewIntent reuses the same window, so the flag stays set.
• The fix protects only the ContactsPickerActivity window. The manifest in the material declares no other activity in this app.
• The call depends on the manifest declaring HIDE_OVERLAY_WINDOWS, which the fix adds.
• The fix does not change the privacy banner or any disclosure logic. It only stops other apps' non-system overlays from being drawn over the picker.

Behavior changes

• While ContactsPickerActivity is shown, the window manager hides other apps' non-system overlay windows (for example SYSTEM_ALERT_WINDOW overlays).
• ContactsPicker now requests android.permission.HIDE_OVERLAY_WINDOWS.

Per major

• Android 14: Not affected per the bulletin. The project packages/apps/ContactsPicker is not present at android-security-14.0.0_r29 (code absent).
• Android 15: Not affected per the bulletin. The project is not present at android-security-15.0.0_r17 (code absent).
• Android 16: Not affected per the bulletin. The project is not present at android-security-16.0.0_r8 (code absent).
• Android 17: Same fix: commit f44519d86b51 (cherry-pick of 9c389023fc9b) in android-security-17.0.0_r1. All 8/8 patched lines are present.

Unknowns

• The material describes what the privacy banner contains, and how hiding it leads to disclosure, only in the commit message, not in the diffed code.

Back to September 2026 · Findings