Exploiting Android Apps with Counterfeit Art
Philipp Mao, Rokhaya Fall
OffensiveCon 2026 · Day 2 · Main Stage
This talk, "Exploiting Android Apps with Counterfeit Art," presented by Philipp Mao and Rokhaya Fall, delves into a novel and powerful technique for escalating file override vulnerabilities in Android applications to arbitrary code execution. The speakers introduce the **ART image** file, a core component of the Android runtime, as a universal and writable target for such exploits. While file override bugs are common, turning them into reliable code execution has historically been challenging due to restrictions on writing to executable code within an app's sandbox. Mao and Fall demonstrate that manipulating the ART image bypasses these limitations, opening a new avenue for attackers.
AI review
Mao and Fall identify the ART image as a universal, writable escalation target for file-override bugs in Android — a class of vulnerability the community has been sitting on for years without a reliable code-execution primitive. The two-path exploit chain (LZ4 OOB write for local, relocation-abuse + ClassLinker bypass + section overlay for blind remote) is genuinely novel, mechanically elegant, and demonstrated against shipping hardware. This is the kind of research that retroactively changes the CVSSv3 scores on a dozen closed bugs.