80093 matches found
streambox-cve-2026-28618
Zero-click APV, in a player that auto-plays shared clips CVE-2026-28618 in StreamBox — the same decoder class as the in-the-wild Android APV RCE, turned into a heap write against a session object. This repo is a public, redacted writeup: flags, instance tokens, and the HMAC key are omitted. The A...
CVE-2026-21018
SveService Buffer Overflow Samsung SMR May 2026 SVE-2026-0478CVE-2026-21018 Affected versions: Android 14, 15, 16 Disclosure status: Privately disclosed Out-of-bounds write in SveService prior to SMR May-2026 Release 1 allows local privileged attackers to execute arbitrary code. The patch adds...
Zygotroller
Zygotroller Remove profile owners/Family Link on ANY pre June 2024 Developer Mode device Android 12+ Zygotroller is a proof-of-concept that can remove a profile owner and associated restrictions with CVE-2024-31317's Zygote injection bug. It requires developer mode and the latest security patch t...
CVE-2024-0044
CVE 2024 0044 CVE-2024-0044, identified in the createSessionInternal function of the PackageInstallerService.java file, is a high-severity vulnerability affecting Android versions 12 and 13. This vulnerability allows an attacker to perform a "run-as any app" attack, leading to local escalation of...
pyjadx
pyjadx Python bindings for JADX via JPype. Decompile Android APK and DEX files to Java source from Python. root@kitploit: from pyjadx import Jadx with Jadx"app.apk" as jadx: for cls in jadx.classes: printcls.fullname printcls.code Why pyjadx? JADX is the leading open-source Android decompiler — i...
android-kernel-exploitation-ashfaq-CVE-2019-2215
android-kernel-exploitation-ashfaq-CVE-2019-2215. Docker image provided by user Robert Dan in the workshop android-kernel-exploitation-ashfaq-CVE-2019-2215...
CVE-2018-9539
CVE-2018-9539 Proof-of-concept code for CVE-2018-9539 If you have any questions, you are welcome to DM me on Twitter @tamirzb. Build In order to build this: 1. Download the Android source code. 2. Put this repository in AOSP/external. 3. Run the following commands: root@kitploit: cd AOSP source...
CVE-2026-43499-popsicle
CVE-2026-43499 for popsicle This repository contains an Android 16 local privilege escalation implementation for CVE-2026-43499 on Xiaomi 17 Pro Max popsicle. Verified kernel: root@kitploit: 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k Devices with this kernel Xiaomi 17, Pro, and Ultra...
packages_apps_KeyChain_AOSP10_r33_CVE-2021-0963
This repository does not have a README...
DirtyCow-EXP
DirtyCow-EXP Compiled Dirty Cow vulnerability CVE-2016-5195 EXP, divided into Linux platform and Android platform. For detailed vulnerability reproduction, please refer to: https://brucetg.github.io/2018/05/27/DirtyCow%EF%BC%88%E8%84%8F%E7%89%9B%EF%BC%89%E6%BC%8F%E6%B4%9E%E5%A4%8D%E7%8E%B0/...
AOSP-DownloadProviderDbDumper
AOSP-DownloadProviderDbDumper PoC Exploiting SQL Injection in Android's Download Provider CVE-2018-9493 Security Advisory https://ioactive.com/wp-content/uploads/2019/04/IOActive-Security-Advisory-Androids-Download-Provider-SQL-Injection-CVE-2018-9493.pdf More Information...
CVE-2020-11179-Adreno-Qualcomm-GPU
My independent work from the poc created by P0 researcher Ben Hawkes Original article: https://googleprojectzero.blogspot.com/2020/09/attacking-qualcomm-adreno-gpu.html My goal is to convert his poc to C, and continue where he left off and turn the poc into either a root shell, or a kernel r/w, a...
Exploit for Heap-based Buffer Overflow in Google Android
Zero-click APV, in a player that auto-plays shared clips CV...
zygote-injection-toolkit
Zygote injection toolkit This is a Python command-line utility to easily run and backup private app data using the Android Zygote injection vulnerability CVE-2024-31317. To run this, you must have any device that has not been updated to the June 1, 2024 security patch. If you don't know whether...
CVE-2024-0039-Exploit
CVE-2024-0039-Exploit Description Python script for exploiting CVE-2024-0039: arbitrary code execution on vulnerable Android devices. WARNING : This code is intended for educational and constructive purposes only, on the side of good, so to speak! Usage Run the script with the necessary arguments...
CyberMeowfiaNS
CyberMeowfia Android Kernel Research 本仓库整理 Android 内核样本分析的方法、工具和案例记录，主题沿用 CyberMeowfia。研究主线是 CVE-2026-43499 与 CVE-2026-43074。内容是概念验证与方法说明：如何判断根因、绑定精确身份、选择路线、记录证据，以及如何解释成功或失败。 This repository documents methods, tools, and case records for Android kernel sample analysis, following the CyberMeowfia...
mtk_su
MTK SU MTK SU is a LPE for CVE-2020-0069. This exploit was tested on a TCL LX A502DL with a MediaTek MT6739 SoC running Android 8.1.0. Build root@kitploit: mkdir build cd build export ANDROIDNDK= cmake -DCMAKETOOLCHAINFILE="$ANDROIDNDK?/build/cmake/android.toolchain.cmake"...
frida-il2cpp-datacollector
frida-il2cpp-datacollector Porting ce's monodatacollector to android/ios. Operation has been confirmed with CEVersion 7.4.2 or later. Usage initial setting Install python library. root@kitploit: pip install pywin32 Fixing autorun/monoscript.luaSetup for CE to recognize Mono as valid 1comment out...
CVE-2023-35674
Description CVE-2023-35674 is a high-severity zero-day security vulnerability in the Android Framework. This vulnerability allows an attacker to escalate their privileges without requiring user interaction or additional execution permissions. The vulnerability occurs in how the Android Framework...