android-security-16.0.0_r3 to android-security-16.0.0_r4 AOSP changelog

This only includes the Android Open Source Project changes and does not include any changes in any proprietary components included by Google or any hardware manufacturer. The raw log was generated using a modified version of this script written by JBQ and improved by Al Sutton.

Please do not copy this without attribution to this site and JBQ for the original script.

+- Project: platform/build

e45e0327af : Version bump to BP2A.250805.021 [core/build_id.mk] 24cc949b8b : Version bump to BP2A.250805.020 [core/build_id.mk] d8b68aade7 : Version bump to BP2A.250805.019 [core/build_id.mk] 18706a4f75 : Version bump to BP2A.250805.018 [core/build_id.mk] 2b3a1b1052 : Version bump to BP2A.250805.017 [core/build_id.mk] ae827872ee : Version bump to BP2A.250805.016 [core/build_id.mk] bb22cea2ba : Version bump to BP2A.250805.015 [core/build_id.mk]

+- Project: platform/build/release

948406421 : Revert "Select sqlite 3.44.5 on ap3a"

+- Project: platform/external/dng_sdk

6b5cf2a : Update to DNG SDK 1.7.1 2410

+- Project: platform/external/libopenapv

cf0a0e7 : Upgrade libopenapv to v0.2.0.0 c81fcd4 : Upgrade libopenapv to v0.1.13.1 86a76fd : Revert "APV: Local fix for OpenAPV library"

+- Project: platform/external/sqlite

aaebce3 : Copy 25Q2 sqlite 3.44.5 into 3.44.3 directories 1612b56 : Revert "Install sqlite 3.44.5 source files"

+- Project: platform/frameworks/av

ebdbf918dd : Fix vulnerability in drmserver

+- Project: platform/frameworks/base

d6a4c2f29305 : Add missing import 3bbdaf62767b : Fix build issues after cherrypick in NMSTest (pt 2) fd6f923dc9c2 : Fix build issues after cherrypick in NMSTest 51368785bd09 : [UidMigration] fix update uninstallation with sharedUserMaxSdkVersion e363f8210456 : Limit the number of services (NLSes, etc) that can be approved per user d17f6214cd67 : Block overriding satellite carrier config keys on user builds 924df83d73d9 : Remove any revoked associations after reboot bb15e7f14f63 : MediaSession: Enforce max name length on broadcast receivers too 014dea279c49 : Be more strict about content types for message array 1e6af3296d50 : Prevent long press on profile notifs when locked a37dfe713785 : [PM] Check unknown sources for intent installation 4dc009cd724c : Reapply "[PM] Check unknown sources user restriction for intent installation" 7b9a906980a3 : Apps clearing self data shouldn't get permissions restored b88956f3198d : Update isSameApp check 09055276288a : Explicitly unset INSTALL_FROM_MANAGED_USER_OR_PROFILE flag c148b4fae634 : Prevent launchedFromPackage spoofing via FLAG_ACTIVITY_FORWARD_RESULT. cee45869c491 : Handle loadDescription OutOfMemoryError in DeviceAdminInfo a438ce172b44 : Introduce InputMethodSubtypeSafeList 2bca2265ff3e : Harden InputMethodInfo parsing against large metadata cea235f00865 : Fixed "Unlock your phone" unexpectedlly turned ON after OTA 7783a5265907 : Sanitize a11y qs shortcut tile service name before using it e770e9f02341 : Trim permission, permission group names a4523e227733 : Prohibit untrusted proxys from specifying proxied attribution tags b51a58ecec96 : Ensure sandboxed UIDs are treated as untrusted in Appops ef2a8e203164 : [ENR] Only skip hide sensitive anim for showing public bc34b284c508 : Revert^2 "Fix build failure in release branch" b914bcc9d019 : Revert "Fix build failure in release branch" a9caac794459 : RESTRICT AUTOMERGE Ignore pinned Windows (Consolidated fix) 89597d06053e : Revert "Ignore pinned Windows" 92b109b60414 : [RESTRICT AUTOMERGE] Stay in app pinned mode upon SystemUI crash b98e69170ae0 : Fix build failure in release branch 2c84985e4257 : Ignore pinned Windows a819a9650c52 : Use target sdk for background check on Wear remote intents.

+- Project: platform/frameworks/native

c81cf36148 : Clip to layer bounds when drawing blur regions 8ec74c568b : Truncate WindowInfo.name during parcelling.

+- Project: platform/hardware/st/nfc

c6da9ee : [NFC] Fix use-after-free in eventCallback

+- Project: platform/packages/apps/DocumentsUI

9f2d3f09f : Prevent a malicious selector from launching an arbitrary activity.

+- Project: platform/packages/apps/Settings

7d8fbee887f : Fixed "Unlock your phone" unexpectedlly turned ON after OTA 48af8a13dd1 : Check permission of the calling package in multi-pane devices 059c9678eeb : Ignore enrollAfterFace in FaceEnroll from ext pkg

+- Project: platform/packages/modules/Permission

9bcd460fc3 : Update RuntimePermissionsUpgradeController to accept null PermGroups ad02441023 : V2 Merge all permissions in a shared UID for every package in that UID 70953c41c6 : Add SystemGalleryRoleBehavior 0809fe6f9a : Revert^2 "Ensure Gallery always shows as system fixed" 5049288666 : Revert "Revert "Display the system gallery storage permission as..." 4f55f5fae1 : Revert "Display the system gallery storage permission as system fixed" e11410da0c : Revert "Ensure Gallery always shows as system fixed"

+- Project: platform/packages/modules/Profiling

ceaaf13 : Validate triggers when added to service 1215317 : Enforce caller provided package names to service

+- Project: platform/packages/modules/Virtualization

f0271f363 : vmbase,pvmfw: aarch64: Clean dcache to PoC not PoU

+- Project: platform/packages/providers/MediaProvider

119013a3d : Throw exception on MediaStore createRequest for non-existent uri 69a25763c : Fix ACCESS_MEDIA_LOCATION bypass via SAF picker 8a710e850 : Fix select button in preview for single-select 61808742c : Revert^2 "Fix: add confirmation step in single select mode." 1b7d4ce44 : Store calling package uid of create bulk requests for permission checks 7ea0a039e : Restore calling identity when exception is thrown 237fb89f5 : [security-aosp-25Q2-staging] Remove default ignoreable characters before regex checks

+- Project: platform/packages/providers/TelephonyProvider

0d45a6a1 : Fix SQL injection vulnerability in SMS/MMS providers 37babc70 : Preventing deleting file that does not belong to parts directory.

+- Project: platform/packages/services/Telephony

20949e75b : Block overriding satellite carrier config keys on user builds