Tools

yukonga/ghostlock-app

GhostLock One-Tap Execution App (CVE-2026-43499)

michalbednarski/thelastbundlemismatch

Writeup and exploit for CVE-2023-45777, bypass for Intent validation inside AccountManagerService on Android 13 despite "Lazy Bundle" mitigation

michalbednarski/reparcelbug2

Writeup and exploit for installed app to system privilege escalation on Android 12 Beta through CVE-2021-0928, a `writeToParcel`/`createFromParcel`…

australeo/cve-2021-28476

Proof-of-concept for CVE-2021-28476, a Hyper-V vmswitch.sys arbitrary pointer dereference allowing guest-to-host denial-of-service and potential RCE.

shaikusaf/system_bt_aosp10_r33_cve-2021-0475

Android Bluetooth stack (Fluoride) with build instructions for AOSP and Linux, including dependency setup and GN/Ninja build steps.

shaikusaf/system_bt_aosp10_r33_cve-2021-0435

AOSP Bluetooth stack repository modified for CVE-2021-0435, providing a patched or vulnerable version for analysis and testing of Bluetooth…

shaikusaf/system_bt_aosp10_r33_cve-2021-0431

Android Bluetooth stack (Fluoride) with a specific patch for CVE-2021-0431, enabling analysis and testing of Bluetooth vulnerabilities in AOSP 10.

joakimbulow/cve-2026-23907

Proof-of-concept exploit for Apache PDFBox path traversal vulnerability (CVE-2026-23907), demonstrating arbitrary file write via malicious PDFs with…

trinadh465/platform_system_netd_aosp10_r33_cve-2023-40084

Android netd vulnerability analysis and exploitation research for CVE-2023-40084, focusing on the platform's network daemon.

trinadh465/frameworks_av_aosp10_r33_cve-2021-0509

Android media framework vulnerability fix for CVE-2021-0509, addressing a use-after-free in audio flinger to prevent local privilege escalation.

hunt-benito/rendering-code-outside-the-sandbox-cve-2026-76036-dawn-webgpu-buffer-overflow-in-chrome-on-android

Differential detection harness for CVE-2026-76036, a Dawn WebGPU heap buffer overflow in Chrome on Android. Probes vulnerable depth/stencil texture…

xingchenrs/cybermeowfians

The next stage of CyberMeowfil (CVE-2026-43499 and 43074),Possibly biased toward vivo devices?

pealeap/cve-2026-21045_and_cve-2026-21048

Generates crafted TIFF/DNG files to trigger out-of-bounds writes in Samsung's libimagecodec.quram.so, including binary analysis and reproduction…

chichou/grapefruit

Open-source mobile security testing suite for iOS and Android. Previously Passionfruit

gmh5225/awesome-game-security

Curated index of game security research: anti-cheat internals, DMA attacks, reverse engineering, kernel/mobile protections, and graphics API hooking…

virtualesp/springpeace

(Hopefully) A tool to root for (most) Android devices through CVE-2026-43499

gmh5225/androiddrivesignity

AndroidDriveSignity is a Python utility designed to bypass driver signature verification in Android kernel(ARMv8.3), facilitating the loading of…