Beyond Sensitive APIs: Detecting Access Control Flaws at Sensitive Callsites in Android Firmware

What it is

Callix is a static analysis framework from UESTC researchers (NDSS 2027, arXiv 2611.00594, October 2026). It looks for insufficient access control at sensitive callsites inside exported ContentProvider components of pre-installed Android apps. The target is generic APIs such as SQLiteDatabase.update that existing sink lists leave out to avoid false positives, but which become dangerous when they touch private data.

Beyond the summary's headline numbers, the evaluation covered 50 firmware images and 424 ContentProviders. Vendors had independently confirmed 278 disclosed reports across 98 providers at the time of writing, and some were rewarded or fixed. Each of the 468 confirmed true positives (of 492 sampled paths) was reproduced with a working proof of concept.

How it works

1. Sensitive callsite identification. It combines the API's operation with the semantics of the data involved, not the API name alone.
2. Check recovery. Each branch condition on the path becomes an explicit security property, recording what is validated and what information the validation uses. Symbolic execution tools treat these conditions only as reachability constraints.
3. Restriction context. This decides whether the recovered checks are enough for the identified operation and data.

The motivating example is a Messaging app on hundreds of millions of devices. Its provider is exported with only android:readPermission="android.permission.READ_SMS", so writes have no permission. update() ends in db.update("rms_db", values, where, args). Its only guard rejects sync-only columns (is_deleted, sync_state, need_download) from non-sync callers. callerIsSyncAdapter(uri) trusts the caller-supplied query parameter caller_is_syncadapter=true, so an attacker sets it and bypasses the guard. The PoC uses getContentResolver().update() on content://rms_db/rms_log?caller_is_syncadapter=true with where set to _id=43, and rewrites an arbitrary SMS or MMS.

The paper's other trigger case is a mid-2025 Polish CERT disclosure. A pre-installed app's provider let any app read the user's PIN without permissions.

Preconditions / Affected

• The provider must be exported, and the sensitive call must be reachable from a public entry point (query, insert, update, delete, openFile, getType, call).
• The checks on the path must be missing, or rely on attacker-controlled input such as URI parameters, request fields or hardcoded values.
• The evaluation covered 1,750 apps from 10 vendors. The page excerpt does not name the vendors.

Caveats

• Precision of 95.1% comes from manual review of a 60% sample, so the unreviewed 40% is unvalidated. The paper reports no recall figure in the excerpt.
• In a 500-path balanced benchmark, a commercial coding agent on the same claude-opus-5 backend, given the same evidence and criteria, scored 6.6 F1 points below Callix. The authors read this as showing that structured application of the criteria matters.
• The fetched text stops in the challenges section. Design details, per-vendor results, the breakdown of the 819 paths beyond the 42.1% involving generic database operations, and any mitigation guidance were not available.