CVE-2024-48336

The install function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app and escalate privileges to root via a craft...

CVE-2024-48336

The Magisk app (Manager v7.0.0 through Canary 27006) is vulnerable to arbitrary code execution due to a flaw in the install() function of ProviderInstaller.java. The application fails to verify that the GMS app is a system application before loading it, allowing a local untrusted app with no extr...