Require signature|privileged STATUS_BAR for collapsePanels()
For apps targeting S+. This API was being exploited by malware to prevent the user from accessing critical notifications (go/collapse-status-bar, b/137274359). This API was hidden and never intended to be used by 3p apps, so putting it behind proper permission after targetSdk S. Since it's @UnsupportedAppUsage trying to steer apps to the Intent.ACTION_CLOSE_SYSTEM_DIALOGS (Intent.ACSD), which produces the same effect and has been part of the API surface (as opposed to this one). However, to fix the vulnerability (b/137274359) that intent will be subjected to further restrictions based on privilege (who) and circumstance (what), for more details see go/close-system-dialogs. To lock down the abuse vector, similar restrictions to the ones applied to Intent.ACSD will be applied to collapsePanels() NOT gated on targetSdk, but these will be in future CLs. Test: CTS coming Bug: 173031413 Bug: 159105552 Bug: 137274359 Change-Id: I05f05ff6a2052820a132c2284101480448d18b77
Loading
Please register or sign in to comment