CVE-2024-0015

HIGH

Google Android Intent Redirection - Privilege Escalation

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2024-0015. PoCs published by UmVfX1BvaW50.

AI-analyzed exploit summary The repository contains minimal Android app code (MainActivity and DreamService) with no functional exploit logic. The README mentions a PoC but lacks technical details or actual exploit implementation.

Description

In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

Exploits (1)

nomisec STUB 18 stars
by UmVfX1BvaW50 · poc
https://github.com/UmVfX1BvaW50/CVE-2024-0015

The repository contains minimal Android app code (MainActivity and DreamService) with no functional exploit logic. The README mentions a PoC but lacks technical details or actual exploit implementation.

Classification
Stub 90%
Attack Type
Other
Complexity
Trivial
Reliability
Theoretical
Target: Unknown (Android-based, likely a specific app or service)
No auth needed
Prerequisites: Android environment · Target application context
devstral-2 · analyzed Feb 18, 2026 Full analysis →

References (2)

Core 2

Scores

CVSS v3 7.8
EPSS 0.0038
EPSS Percentile 29.2%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-280
Status published
Products (4)
google/android 11.0
google/android 12.0
google/android 12.1
google/android 13.0
Published Feb 16, 2024
Tracked Since Feb 18, 2026