Commit 61fc2523 authored Mar 07, 2025 by Daniel Norman Committed by Evelyn Torres Jan 26, 2026

fix: Unbind an A11yService from onNullBinding

With this fix, a service which returns null in onBind() will no longer
stay bound by system_server and will no longer be able to launch
activities from the background.

Bug: 386950836
Test: Follow steps in the bug to reproduce the issue; observe that BAL
      is no longer allowed.
Test: atest android.security.cts.Bug_386950836
Flag: EXEMPT security bugfix
(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:26580c52200ad1c6347c8a1eef38db1ac8ce2c68)
Merged-In: Id04111b061881d23346aa90a0b5d08a28bed2c6f
Change-Id: Id04111b061881d23346aa90a0b5d08a28bed2c6f

parent 4e82563a

services/accessibility/java/com/android/server/accessibility/AccessibilityServiceConnection.java

+10 −0

Original line number	Diff line number	Diff line
		@@ -238,6 +238,16 @@ class AccessibilityServiceConnection extends AbstractAccessibilityServiceConnect
		}
		}

		@Override
		public void onNullBinding(ComponentName componentName) {
		// Per guidance from ServiceConnection we must call Context#unbindService here to
		// release the tracking resources associated with the ServiceConnection, to prevent
		// Background Activity Launches (BAL).
		synchronized (mLock) {
		unbindLocked();
		}
		}

		@Override
		protected boolean hasRightsToCurrentUserLocked() {
		// We treat calls from a profile as if made by its parent as profiles