Prevent side channel package installation enumeration
From Android 11, apps need the permission QUERY_ALL_PACKAGES to probe existence of arbitrary installed packages. However, an Activity which declares android:scheme="package in intent-filter may be vulnerable and attacker app can use it to probe installed packages. This change add permission QUERY_ALL_PACKAGES to protect vulnerable Activity. Bug: 185477439 Test: Install POC and check if it can probe installed packages by each vulnerable Activity. Change-Id: I521545436102f72f2e0c5053e30fd03bd6bc756f
Loading
Please register or sign in to comment