EIP-2026-100029

This exploit leverages a vulnerability in Android's Binder IPC mechanism where attacker-controlled binder handles are misinterpreted as string data, leading to memory address leakage of system services like 'permission', 'package', and 'clipboard'. The PoC demonstrates this by echoing leaked addresses via the clipboard service.