CVE-2026-28631 AI-generated analysis

platform/frameworks/base, core/java/com/android/internal/app/IntentForwarderActivity (cross-profile intent forwarding, mini resolver consent UI)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (5 corrections). Verify against the commit before relying on it.

Adds getWindow().setHideOverlayWindows(true) to the mini resolver consent dialog that IntentForwarderActivity shows before redirecting an intent into the managed profile, so overlay windows are hidden over the consent UI. A companion commit moves the executor and device-provisioned lookups behind the Injector so the activity test can run.

Root cause

On Android 14, IntentForwarderActivity.onCreate shows a consent dialog when the caller is not privileged enough to skip consent and the target is not the profile owner. It inflates R.layout.miniresolver with setContentView and asks the user to confirm opening the intent in the work profile (button_open calls startActivityAsCaller). This consent window was never marked with setHideOverlayWindows(true), so overlay windows from other apps could stay visible above it while the user decided.

How the fix works

• Commit cb471de52128 (Set hide overlays on mini resolver), core/java/com/android/internal/app/IntentForwarderActivity.java:onCreate: adds getWindow().setHideOverlayWindows(true) right after setContentView(R.layout.miniresolver). This one line is the entire security change.
• Commit 2fadc52d7f18 (Fix & speed up IntentForwarderActivityTest), applied on top of cb471de52128: core/java/com/android/internal/app/IntentForwarderActivity.java adds Injector.getExecutorService() and Injector.isDeviceProvisioned(). onCreate now uses mInjector.getExecutorService(), whose default still returns Executors.newSingleThreadExecutor(). isDeviceProvisioned() now delegates to mInjector.isDeviceProvisioned(), whose default still reads Settings.Global.DEVICE_PROVISIONED. Production behavior does not change.
• Same commit, core/tests/coretests/AndroidManifest.xml: adds uses-permission android.permission.HIDE_OVERLAY_WINDOWS. Per the commit message, without it IntentForwarderActivity crashes when it calls setHideOverlayWindows() in the test.
• Same commit, core/tests/coretests/src/com/android/internal/app/IntentForwarderActivityTest.java: TestInjector now provides a synchronous AbstractExecutorService and returns true from isDeviceProvisioned(). The commit also removes the 30 s awaitTermination in the wrapper onCreate and the direct Settings.Global writes, and replaces two backwards assertNull checks with assertNotNull.

Completeness

• setHideOverlayWindows(true) is applied only in the mini resolver path, the block that calls setContentView(R.layout.miniresolver). In the material this is the only interactive UI that IntentForwarderActivity inflates. The skip-consent path (privilegedCallerAskedToSkipUserConsent or intentToLaunchProfileOwner) calls startActivityAsCaller and finish() without setting content, and showToast only displays a Toast.
• The second commit is a test enabler and Injector refactor. It adds no protection and changes none. It fixes existing assertions, and the material shows no test that checks the hide-overlay flag.
• The material does not show whether the full-size ResolverActivity or other resolver UIs set the same flag.

Behavior changes

• While the mini resolver consent dialog of IntentForwarderActivity is shown, its window has hide-overlay-windows set, so non-system application overlay windows are hidden for that time (semantics of Window.setHideOverlayWindows, general platform knowledge).
• setHideOverlayWindows requires android.permission.HIDE_OVERLAY_WINDOWS. Any host without it fails (general platform knowledge). For the test host, the commit message confirms this.
• Executor creation and the DEVICE_PROVISIONED read now go through the Injector. The default implementations are unchanged.

Per major

• Android 14: same fix: cb471de52128 adds the one line in onCreate right after setContentView(R.layout.miniresolver), and the test refactor 2fadc52d7f18 is applied on top. Both are in android-security-14.0.0_r29 (linked by bug_id). 4/4 patched lines present.
• Android 15: adapted fix: 8e66b48894f7 in android-security-15.0.0_r17 adds the same line after setContentView(R.layout.miniresolver). On 15 the mini resolver is built in a separate helper method (parameters resolverTitle and pmForTargetUser, around line 330), not inline in onCreate. 4/4 patched lines present.
• Android 16: The material shows only the test refactor 71d6dc109528 in android-security-16.0.0_r8: the same Injector changes plus removal of the IntentForwarderActivityTest exclude filter in core/tests/coretests/Android.bp. No setHideOverlayWindows commit is shown for 16. The resolver reports 8/8 patched lines present.
• Android 17: Same as 16: 323c8b968a88 in android-security-17.0.0_r1 (linked by change_id) is the test refactor, including the Android.bp exclude-filter removal. No separate setHideOverlayWindows commit is shown. 8/8 patched lines present.

Unknowns

• Whether, and in which commit, the setHideOverlayWindows(true) line landed on Android 16 and 17. The material shows only the test refactor for those branches.
• Whether the parent-forwarding path (FORWARD_INTENT_TO_PARENT) can reach the mini resolver consent dialog.
• Whether other resolver UIs (for example ResolverActivity in frameworks/base or the IntentResolver module) already set the same flag.
• The material shows no regression test for the hide-overlay flag.

Back to September 2026 · Findings