Description
In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Android | 15, 14, 13, 12L, 12 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 15 repositories · most starred shown
-
0xbinder/CVE-2024-0044 ★ 330 · Jun 18, 2024
CVE-2024-0044: a "run-as any app" high-severity vulnerability affecting Android versions 12 and 13
-
canyie/CVE-2024-0044 ★ 183 · Sep 27, 2024
RunAsAnyone: PoC and writeup for bypassing the initial patch of CVE-2024-0044, Android run-as any app vulnerability allowing privilege escalation from adb to installed app
-
scs-labrat/android_autorooter ★ 80 · Jun 18, 2024
Exfiltrate sensitive user data from apps on Android 12 and 13 using CVE-2024-0044 vulnerability remotely
-
sridhar-sec/EvilDroid ★ 32 · Aug 4, 2024
EvilDroid automates the exploitation of CVE-2024-0044, installing malicious payloads on a target device and extracting sensitive data. It features automated ADB connection checks, APK pushing, UID ex…
-
Re13orn/CVE-2024-0044-EXP ★ 16 · Jul 3, 2024
利用 CVE-2024-0044 Android 权限提升下载任意目标App沙箱文件。
-
MrW0l05zyn/cve-2024-0044 ★ 12 · Aug 19, 2024
CVE-2024-0044
-
hackerronin/CVE-2024-0044 ★ 6 · Aug 13, 2024
a vulnerability affecting Android version 12 & 13
-
007CRIPTOGRAFIA/c-CVE-2024-0044 ★ 4 · Jul 11, 2024
CVE-2024-0044: uma vulnerabilidade de alta gravidade do tipo "executar como qualquer aplicativo" que afeta as versões 12 e 13 do Android
-
bfurkanyildiz/Android-rce-analizi ★ 2 · Apr 25, 2026
Android CVE-2024-0044, 43093, 23706 zafiyet analizi ve PoC lab ortamı
-
TheBl4ckPh4nt0m/CVE-2024-0044 ★ 2 · Dec 9, 2024
CVE-2024-0044: a "run-as any app" high-severity vulnerability affecting Android versions 12 and 13. This repo demonstrates how to exploit CVE-2024-0044. For educational and testing purposes only.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- NCSC-2024-0391 Kwetsbaarheden verholpen in Google Android en Samsung Mobile NCSC-NL (Netherlands) · Oct 8, 2024
- WID-SEC-2024-3096 Android Patchday Oktober 2024: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 7, 2024
- WID-SEC-2024-0551 Android Patchday März BSI CERT-Bund (WID) · Jun 4, 2024
- WID-SEC-2024-0550 Samsung Android: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 4, 2024