CVE-2025-0087
MEDIUMAndroid - Local Privilege Escalation via UninstallerActivity Permission Bypass
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2025-0087. PoCs published by SpiralBL0CK.
AI-analyzed exploit summary This is a Frida-based exploit for CVE-2025-0087 targeting Android's Package Installer, combining local privilege escalation (LPE) techniques such as root shell attempts, tapjacking, and intent hijacking. The exploit hooks into the UninstallLaunch activity to manipulate user handles and escalate privileges.
Description
In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Exploits (2)
This is a Frida-based exploit for CVE-2025-0087 targeting Android's Package Installer, combining local privilege escalation (LPE) techniques such as root shell attempts, tapjacking, and intent hijacking. The exploit hooks into the UninstallLaunch activity to manipulate user handles and escalate privileges.
This PoC demonstrates a denial-of-service (DoS) vulnerability in the Android Package Installer by injecting an oversized label via Frida-based hooking of the `loadLabel` method, causing potential truncation or overflow issues.
References (2)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L