CVE-2024-48336

CVE-2024-48336 affects Magisk App; the install() function in ProviderInstaller.java fails to verify the GMS app before loading it, permitting a local untrusted app to silently execute code in Magisk and escalate to root. Affected: Magisk App builds before Canary 27007. Root cause: loading code fr...

CVE-2024-48336

The install function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app and escalate privileges to root via a craft...