streambox-cve-2026-28618

Zero-click APV, in a player that auto-plays shared clips CVE-2026-28618 in StreamBox — the same decoder class as the in-the-wild Android APV RCE, turned into a heap write against a session object. This repo is a public, redacted writeup: flags, instance tokens, and the HMAC key are omitted. The A...