LeakValue icon indicating copy to clipboard operation
LeakValue copied to clipboard

Exploit for CVE-2022-20452, privilege escalation on Android from installed app to system app (or another app) via LazyValue using Parcel after recycle()

Results 4 LeakValue issues
Sort by recently updated
recently updated
newest added

Hi, thank you very much for sharing this research. I notice that in ```makeHolderLeakerWithRewind()```, first a ```Message``` of a large size (might reach the max size?) was transacted, and then...

When I pressed the start button after the app is installed, it will prompt "java.lang.NoSuchMethodException: android.media.session.ISession$Stub$Proxy.getBinderForSetQueue []" error. I found the exact code is:mGetBinderForSetQueue = mMediaSessionBinder.getClass().getMethod("getBinderForSetQueue"); I use android api...

My Device: Pixel 6 Android 13.0.0 (TQ1A.230105.002, Jan 2023) It doesn't work

So, I tried to run this app. I have issue, in which I can't receive any leaked binders from `doAllStuff()`. I got an empty array list `leakedBinders`. I think this...