CVE-2026-0013

Android DocumentsUI Confused Deputy Vulnerability - Security Research Verification Project

Important Notice

This repository is a derived build repository, affiliated with the original upstream repository.

Security Protocol

Before accessing this repository, please read and understand SECURITY_PROTOCOL.md.

Key points:

• This repository does not provide source code, attack tools, or exploit frameworks
• Build artifacts are security research verification samples, for academic research only
• The repository creators are not responsible for any financial loss or legal consequences
• Users assume full responsibility

Quick Start

GitHub Pages: https://XiaoBaiLovesStirring.github.io/cve-2026-0013-poc/

Trigger build: https://github.com/XiaoBaiLovesStirring/cve-2026-0013-poc/actions

Get artifacts: git clone --branch artifacts https://github.com/XiaoBaiLovesStirring/cve-2026-0013-poc.git

Changelog

v1.0.4 (2026-08-23) - EXTRA_INTENT proxies launch of a self-built component

Changes: Point the targetIntent that DocumentsUI is requested to launch at the new self-built component IdTestActivity. This component executes id and writes the runtime identity and results to logcat and the notification bar, to empirically verify two key facts:

1. Whether OPPO's PickActivity actually consumes Intent.EXTRA_INTENT and launches the target component on its behalf
2. Which UID/process the proxy-launched component actually runs in

Mechanism note (important): According to the Android isolation model, any component of a third-party app runs only within the process/UID it declares, regardless of who launches it. Relying solely on DocumentsUI's proxy launch, IdTestActivity will still run under com.example.cve20260013exploit's own UID (e.g., u0_a702/10702) and will not automatically become DocumentsUI's uid=10054. To give the entire APK UID 10054, you need sharedUserId="android.uid.documentsui" (requires a system signature, unavailable to third parties) or a root environment. The value of v1.0.4 lies in verifying whether EXTRA_INTENT is consumed and the true identity of the proxy launch.

v1.0.3 (2026-08-23) - Fix trigger chain (EXTRA_INTENT stripped)

Problem: On OPPO/ColorOS, DocumentsUI's PickActivity no longer consumes the Intent.EXTRA_INTENT passed by the caller. In real-world testing, mCallingUid remained the caller u0_a702; PickActivity merely rendered its own selection UI and then stopped, with no target action launched on behalf of DocumentsUI (uid=10054). The original confused deputy chain was effectively broken.

Fix (trigger chain redesign):

• Abandon the "hardcoded class name + EXTRA_INTENT" approach; instead let the system Activity Resolver resolve DocumentsUI for a legitimate Intent (ACTION_OPEN_DOCUMENT / ACTION_GET_CONTENT + CATEGORY_OPENABLE + */*)
• Keep explicit targeting fallbacks for OPPO's modified entry picker.PickActivity and the native entry PickActivity, to prevent crashes when no entry is found
• Reverse-look up the grant host identity from the content:// temporary grant URI returned by DocumentsUI (probeUriGrant), verifying from the grantor's perspective whether the confused deputy holds
• Add step-by-step tracing to the trigger chain (resolver resolution result + final launched component), written to logcat and the notification bar, so the chain path can be confirmed directly on the device

Mechanism note: The app itself cannot make the DocumentsUI process execute arbitrary commands on its behalf; the "privilege escalation" of the confused deputy is reflected in having it hold/forward the authorized resources it can only obtain with its own uid on your behalf. Therefore v1.0.3 instead verifies "who received the URI permission granted by DocumentsUI", rather than executing id inside the app's own process.

Build fix log: The first build failed because getPackageManager().resolveActivity() returns ResolveInfo rather than ComponentName, with the error error: incompatible types: ResolveInfo cannot be converted to ComponentName. Fixed by constructing a ComponentName from the packageName/name extracted from ResolveInfo.activityInfo, after which the build passed.

v1.0.2 (2026-08-23) - Execute the id command and display it in the notification bar

Changes: Changed the proof-of-concept action from "launch Termux" to "execute the id command after triggering the confused deputy chain, and display the result in the system notification bar".

• After triggering the DocumentsUI confused deputy chain, execute the id command in-app (trying multiple paths: sh -c id, id, /system/bin/id, /system/xbin/id)
• Display execution results such as uid/gid/groups in the notification bar
• Keep the vendor-modified entry fallback logic (picker.PickActivity → native .PickActivity)
• Add the Android 13+ POST_NOTIFICATIONS permission to send notifications

v1.0.1 (2026-08-23) - Adapt to vendor-modified entries

Problem: Multiple vendors (e.g., OPPO) modified the class path of DocumentsUI, moving the native entry com.android.documentsui.PickActivity to com.android.documentsui.picker.PickActivity, causing previous build artifacts to be unable to locate the exploit entry on target devices.

Fix:

• Update the default exploit entry to com.android.documentsui.picker.PickActivity
• Add entry availability detection; if the sub-package entry does not exist, automatically fall back to the native path .PickActivity
• Fallback logic: when the modified entry is detected as unavailable, log it and try the native path

Build failure troubleshooting guide (important):

• If the cloud build fails, first check the GitHub Actions run logs to locate the specific error
• If the error is something like "entry not found / Activity not found", it means the target vendor has modified the DocumentsUI class path
• Use dumpsys package com.android.documentsui or the Activity Resolver Table to confirm the actual entry class name after vendor modification, then modify the setClassName parameter in ExploitActivity.java and push to trigger a rebuild

Vulnerability Information

CVE-2026-0013 | HIGH (CVSS 8.4) | CWE-441 | Android 14-16 | DocumentsUI PickActivity

Fix announcement: Android Security Bulletin 2026-03-01