CVE-2026-28657 AI-generated analysis

platform/frameworks/base, AppWidget (core/java/android/appwidget/AppWidgetConfigActivityProxy.java)

AI-generated: written from the bulletin and the fixing diffs by claude-fable-5-1, then checked against the code by claude-opus-5-5 (4 corrections). Verify against the commit before relying on it.

AppWidgetConfigActivityProxy.onActivityResult now forwards only the extras of the configuration activity's result Intent (via a fresh Intent().putExtras(data)) instead of the original Intent. URI permission grant flags and the data URI from the widget provider are therefore no longer relayed through the system-privileged proxy's setResult().

Root cause

AppWidgetConfigActivityProxy is a @hide activity. Per the commit message, it is system-privileged and its PendingIntent is created by the system. It starts the widget provider's configuration activity with startActivityForResultSafely(target, CONFIG_ACTIVITY_REQUEST_CODE). In onActivityResult it called setResult(resultCode, data) with the exact Intent returned by that configuration activity. Per the commit message, URI permission grant flags in that Intent caused the system to grant those permissions, so a malicious widget provider could obtain URI permissions it was not entitled to.

How the fix works

• core/java/android/appwidget/AppWidgetConfigActivityProxy.java:onActivityResult: replaces setResult(resultCode, data) with `Intent result = data != null ? new Intent().putExtras(data) : null; setResult(resultCode, result);`. The new Intent carries only the extras Bundle. Flags, data URI, MIME type and the other non-extras fields of the untrusted Intent are dropped. The widgetId lookup and the AppWidgetManager.setConfigActivityComplete(widgetId) call are unchanged.
• Same file: removes the imports android.view.View, ViewGroup, WindowManager and WindowManagerWrapper (no functional effect).
• core/tests/coretests/src/android/appwidget/AppWidgetConfigActivityProxyTest.kt (new): FakeConfigWithFlagsActivity returns a result with content:// data and all four FLAG_GRANT_* flags. Test onActivityResult_stripsUriPermissions asserts resultData.flags == 0 and resultData.data == null. Test onActivityResult_preservesAppWidgetIdExtra asserts that the EXTRA_APPWIDGET_ID extra survives.
• core/tests/coretests/AndroidManifest.xml: registers FakeConfigActivity, FakeConfigWithFlagsActivity and AppWidgetConfigActivityProxy as exported activities in the test APK. core/tests/coretests/Android.bp: adds test_module_config FrameworksCoreTests_android_appwidget (filter android.appwidget.). core/tests/coretests/src/android/appwidget/TEST_MAPPING: adds it to presubmit.

Completeness

• The fix changes the result-forwarding path in onActivityResult. Everything except the extras is dropped, so it does not depend on a flag mask. The visible code shows only onCreate and onActivityResult; the rest of the file is not in the material.
• The extras Bundle is copied verbatim, with no content filtering. The material does not show whether objects inside the extras could affect URI grants.
• The onCreate path (setResult(RESULT_CANCELED) with no Intent, then startActivityForResultSafely on the EXTRA_INTENT target) is untouched. The material does not show startActivityForResultSafely or how the proxy's launching PendingIntent is built.
• Test coverage: the tests assert that flags and data are stripped. Stripping of other fields follows from building a new Intent but is not asserted.

Behavior changes

• The host now receives a result Intent that contains only extras. Action, data URI, MIME type, flags, component and the other non-extras fields set by the configuration activity no longer reach the host through the proxy.
• If the configuration activity returned a non-null Intent with no extras, the host now gets an empty non-null Intent. A null result Intent is still forwarded as null.
• No new error codes or exceptions. The result code is passed through unchanged.

Per major

• Android 14: Not affected per the bulletin. The resolver reports 7/8 lines of the patched region at android-security-14.0.0_r29. That figure does not discriminate, because the fixed 17 tag also shows 7/8. The material does not confirm whether the file exists in 14.
• Android 15: Not affected per the bulletin. The resolver reports 7/8 lines at android-security-15.0.0_r17. Same caveat as 14.
• Android 16: Not affected per the bulletin for base 16 (android-security-16.0.0_r8 shows 7/8 lines, same caveat). The bulletin lists 16-qpr2 as affected, but no 16-qpr2 fix commit is in the material.
• Android 17: Same fix: commit 7d46aaa9199b in android-security-17.0.0_r1 (cherry-pick of internal e2c75d70260a / 80e84dab91f6, Change-Id I770b26d0e28e1090abae452e3bc00af51bf9b30e), linked by bug 498916138. The resolver shows 7/8 lines at the fixed tag.

Unknowns

• How, and by which component, the system-created PendingIntent that launches AppWidgetConfigActivityProxy is built, and which hosts use this proxy flow.
• How startActivityForResultSafely is implemented, and whether the proxy has any other result path.
• Whether content in the forwarded extras can influence URI grants when the result is delivered.
• Whether AppWidgetConfigActivityProxy.java exists in the 14/15/16 security tags.
• The 16-qpr2 fix commit is not in the material.

Back to September 2026 · Findings