https://github.com/Ashwesker/Blackash-CVE-2025-48633
The text there:
┌──────────────────────────┐
│ Attacker (C2 Server) │
└────────┬─────────────────┘
│ 1. Delivers malicious APK
│ (phishing, fake app store, drive-by)
▼
┌─────────────────────────────────────────────────────┐
│ Victim's Android 15 Phone │
│ (Security patch < 2025-12-01 → still vulnerable) │
└─────────────────────────────────────────────────────┘
│
┌──────────────┴──────────────┐
▼ ▼
User installs & opens Malicious app runs in background
"Fake Game / Tool" APK (no permissions needed for this CVE)
│
│ 2. App triggers vulnerable Framework API
│ (crafted Intent / Binder transaction)
▼
┌───────────────────────────────────┐
│ Android Framework (buggy) │
│ code in Parcel/Binder handling) │
└───────────────────────────────────┘
│
│ 3. Information Disclosure occurs
│ → Sensitive data leaked without user interaction
▼
Leaked data examples:
• Device ID / IMEI
• Installed app list
• Account tokens
• Contacts / SMS snippets
• Clipboard content
• Location history fragments
│
│ 4. Data silently sent back
▼
┌───────────────────────────────────┐
│ Attacker receives stolen data │
→ Can be sold, used for │
└───────────────────────────────────┘ spying, or chained with
other exploits (e.g. CVE-2025-48572)
Squeeze2664•31m ago
jackwilsdon•6m ago
https://discuss.grapheneos.org/d/27068-grapheneos-security-p...