CVE-2026-0047: Missing Permission Check in ActivityManagerService

Heap of bitmaps stolen from every running app — zero permissions, zero user interaction.

A missing enforceCallingOrSelfPermission(DUMP) check in ActivityManagerService.dumpBitmapsProto() allows any installed app to exfiltrate UI bitmaps from all running processes on Android 16 QPR2 Beta (Baklava).

Note: We did not discover this vulnerability. All credit for finding and responsibly reporting goes to the original researchers. This repository contains our independent patch analysis, reproduction, and educational writeup to help the security community understand the bug class and exploitation techniques involved.

Repository Contents

├── app/                    # PoC exploit app (audit tool UI)
├── attacker/               # "Flashlight Pro" — disguised attacker app
├── apk/                    # Pre-built APKs (ready to install)
│   ├── cve-2026-0047-poc.apk
│   └── flashlight-pro-attacker.apk
├── exploit.sh              # Single-shot exploit script
├── gradle/                 # Gradle wrapper
└── README.md

Setting Up the Test Environment

You need an Android 16 QPR2 Beta (Baklava) emulator with a security patch level before 2026-03-01:

# Download the vulnerable system image
sdkmanager "system-images;android-Baklava;google_apis;arm64-v8a"

# Create an AVD
avdmanager create avd -n baklava -k "system-images;android-Baklava;google_apis;arm64-v8a"

# Boot the emulator
emulator -avd baklava &

# Verify the patch level is pre-fix
adb shell getprop ro.build.version.security_patch
# Anything before 2026-03-01 is vulnerable

Quick Start

Option 1: Single-shot script (recommended)

# Full run: set up emulator, build, exploit, extract stolen bitmaps
./exploit.sh --setup-emulator

# Already have a Baklava emulator running?
./exploit.sh

# Skip build, just run exploit
./exploit.sh --skip-build

Option 2: Pre-built APK

# Install the PoC app
adb install apk/cve-2026-0047-poc.apk

# Open some apps (Settings, email, etc.) to have visible UI
adb shell am start -n com.android.settings/.Settings

# Launch the PoC
adb shell am start -n com.poc.cve20260047/.MainActivity

# Tap "Exploit dumpBitmapsProto()" button

Option 3: Attacker simulation ("Flashlight Pro")

# Install the disguised attacker app — declares ZERO permissions
adb install apk/flashlight-pro-attacker.apk

# Launch it — exfiltration happens silently on startup
adb shell am start -n com.poc.cve20260047.attacker/.MainActivity

How It Works

1. Raw Binder probe — Transaction code #117 on the activity service maps to dumpBitmapsProto(). Sending it without arguments causes a NullPointerException inside AMS (not a SecurityException), proving the method body executes without any permission check.

2. Raw Binder exploit — We use IBinder.transact() to send a hand-crafted Parcel directly to AMS. This bypasses Android's hidden API restrictions entirely — no hidden_api_policy setting needed. The Parcel contains:

   • Interface token (android.app.IActivityManager)
   • Non-null marker + ParcelFileDescriptor (pipe write end)
   • Empty string array (all processes)
   • userId = -2 (USER_CURRENT)
   • dumpAll = true

Result

On a Baklava emulator (BP41.250725.007, patch 2025-08-05) with Settings, Clock, and Files open:

• 679,091 bytes of protobuf data
• 63 valid PNG images stolen from all running apps
• Zero permissions declared by the PoC app

How It Was Fixed

Google added enforceCallingOrSelfPermission(DUMP) as the first line of dumpBitmapsProto(), so unprivileged callers now get a SecurityException before any data is accessed.

References

• Android Security Bulletin — March 2026
• CVE-2026-0047 — NVD
• CWE-280: Improper Handling of Insufficient Permissions
• Blog post: Full analysis and exploitation walkthrough

Credits

Research and PoC by Mobile Hacking Lab. We reproduced this vulnerability independently for educational purposes.

Disclaimer

This proof of concept is provided for educational and authorized security research purposes only. Only use it on devices and environments you own or have explicit permission to test. The authors are not responsible for any misuse.