In hasInteractAcrossUsersFullPermission of AppInfoBase.java

#!/usr/bin/env bash
# check-cve-2026-0021.sh
# Conservative verifier for CVE-2026-0021 on Android devices via adb.
# Logic:
#   - Affected Android branches: 14, 15, 16, 16-qpr2
#   - Android bulletin says security patch level 2026-03-05 or later addresses all issues
# Output:
#   PATCHED    = device not in affected major versions, or SPL >= 2026-03-05
#   VULNERABLE = affected major version and SPL < 2026-03-05
#   UNKNOWN    = cannot determine required properties / adb issues
# Exit codes:
#   0 PATCHED
#   1 VULNERABLE
#   2 UNKNOWN

set -u

SERIAL="${1:-}"
ADB_BIN="${ADB:-adb}"
FIXED_SPL="2026-03-05"

adb_cmd() {
  if [[ -n "$SERIAL" ]]; then
    "$ADB_BIN" -s "$SERIAL" "$@"
  else
    "$ADB_BIN" "$@"
  fi
}

if ! command -v "$ADB_BIN" >/dev/null 2>&1; then
  echo "UNKNOWN - adb not found in PATH"
  exit 2
fi

if ! adb_cmd get-state >/dev/null 2>&1; then
  echo "UNKNOWN - no reachable adb device"
  exit 2
fi

ANDROID_RELEASE="$(adb_cmd shell getprop ro.build.version.release 2>/dev/null | tr -d '\r')"
ANDROID_CODENAME="$(adb_cmd shell getprop ro.build.version.codename 2>/dev/null | tr -d '\r')"
SPL="$(adb_cmd shell getprop ro.build.version.security_patch 2>/dev/null | tr -d '\r')"
BUILD_FINGERPRINT="$(adb_cmd shell getprop ro.build.fingerprint 2>/dev/null | tr -d '\r')"

if [[ -z "$ANDROID_RELEASE" || -z "$SPL" ]]; then
  echo "UNKNOWN - unable to read Android release or security patch level"
  exit 2
fi

# Normalize major release (e.g., 14, 15, 16)
MAJOR="${ANDROID_RELEASE%%.*}"

# Basic SPL format check YYYY-MM-DD
if [[ ! "$SPL" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
  echo "UNKNOWN - unexpected security patch level format: $SPL"
  exit 2
fi

# Determine affected branch
AFFECTED=0
case "$MAJOR" in
  14|15|16)
    AFFECTED=1
    ;;
  *)
    AFFECTED=0
    ;;
esac

if [[ "$AFFECTED" -eq 0 ]]; then
  echo "PATCHED - not in affected Android major versions (release=$ANDROID_RELEASE spl=$SPL)"
  exit 0
fi

# Lexicographic compare is safe for YYYY-MM-DD strings
if [[ "$SPL" < "$FIXED_SPL" ]]; then
  echo "VULNERABLE - affected Android release=$ANDROID_RELEASE spl=$SPL (< $FIXED_SPL); fingerprint=$BUILD_FINGERPRINT"
  exit 1
fi

# Note: this does not validate the device's multi-pane exposure path or OEM backport details.
echo "PATCHED - affected Android release=$ANDROID_RELEASE but spl=$SPL (>= $FIXED_SPL); fingerprint=$BUILD_FINGERPRINT"
exit 0