Disclosure of 7 Android and Google Pixel vulnerabilities

What it is

Oversecured's October 2024 or later roundup (the page is undated, but it cites a Bluetooth fix on 1 November 2024) covers seven Android vulnerabilities it reported to Google. Five are rated High with CVEs. The sixth, a WebView file chooser issue, was downgraded to Low and has no CVE. The seventh is the WorkSource parcel mismatch, which has a CVE but no mechanism in this post. The page says two issues affect Pixel devices only and the rest affect all Android vendors.

How it works

• Camera geolocation, CVE-2024-0017 (Pixel). CameraActivity.shouldUseNoOpLocation() picks LegacyLocationProvider when getCallingPackage() returns null. That happens whenever the caller uses startActivity() instead of startActivityForResult(). An app without location permission can launch IMAGE_CAPTURE with an output extra pointing at its own content provider, then read GPS EXIF tags from the photo. Reported 31 May 2023, fixed 20 December 2023.
• VPN bypass list, CVE-2023-21383 (Pixel). com.google.android.settings.vpn2.AppBypassBroadcastReceiver in Settings is guarded by com.google.android.wildlife.permission.VPN_APP_EXCLUSION_LAUNCH and ADVANCED_VPN_CONFIG, which no system app declares. A malicious app can declare them itself and then send a broadcast that edits the bypass lists. Only system apps can be added (the page's example is Chrome). Reported 2 June 2023, fixed 1 December 2023.
• Bluetooth, CVE-2024-34719. Permission checks ran client-side in BluetoothAdapter. In the com.android.bluetooth service, the check methods build a new AttributionSource from the service's own context and chain the caller's attacker-controlled one with setNext. A raw Binder call with a null attributionSource therefore passes with system privileges. The PoC calls IBluetooth.setName() (transaction 7). The page says most Bluetooth methods, including privileged ones and vendor extensions, are affected. Reported 18 August 2022, fixed 1 November 2024.
• WorkSource, CVE-2023-20963. A parcel/unparcel mismatch lets an app launch arbitrary components of arbitrary apps as the system, which skips exported and permission checks. The post defers the technical detail to Google Project Zero. The Pinduoduo app (Temu's developer) exploited it from 4 March 2022 (version 6.2.0) until the code was removed on 22 February 2023 (version 6.49.0). Reported 17 February 2022, fixed 1 March 2023.
• Device Admin HTML injection, CVE-2021-0600. Settings passes a CharSequence extra, android.app.extra.ADD_EXPLANATION, to the ProfileOwnerAdd screen without converting it to a plain String. A Spanned object built with Html.fromHtml() renders formatted text in the admin request. Reported 29 January 2021, fixed 24 June 2021.
• ContentProvider.openFile(), CVE-2023-21292. IActivityManager.openContentUri() does not preserve the caller's context. Providers that check Binder.getCallingUid() == 1000 or checkCallingPermission() see the system as the caller. The check does not help providers protected by exported or manifest permissions. Reported 19 June 2022, fixed 1 August 2023.
• WebView file chooser (no CVE, Low, unfixed). FileChooserParams.createIntent() produces an implicit intent. Any app can answer it with a file:// URI to the host app's private files, and parseResult() and onReceiveValue() do not check it. The PoC returns file:///data/user/0/com.victim/files/secret.txt. Reported 4 November 2023.

Preconditions / Affected

• The Camera and VPN issues affect Pixel only. The others affect all Android devices.
• The WebView issue matters when the page is attacker-controlled, or when the app forwards picked file contents to third parties such as email or cloud storage.
• The openFile() issue matters for providers, including AOSP and Google ones, that do their own caller checks.

What to do

The page gives no patch levels, only fix dates. Devices patched after those dates (the latest is 1 November 2024, for Bluetooth) should have the fixes for the six patched issues. App developers using onShowFileChooser() are unprotected by Google and must validate returned URIs themselves. The page does not state this as advice.

Caveats

• Google first closed the WebView case as a developer error and the openFile() case as "Works as designed". The second was reopened and fixed after public disclosure.
• Oversecured notes the WorkSource report sat over a year before patching, and only after in-the-wild exploitation was known.
• The post ends with a pitch for Oversecured's scanner.