Published: Mon 14 September 2026
By Mathias Payer
In Academia .
tags: exploitation Android
Arbitrary file overwrite vulnerabilities are, unfortunately, quite common in
Android apps. Often the adversary can control some part of the path to partially
or fully overwrite files in the file system of the application. The attacker
thereby has the power to modify any file writable by the application. The attacker
tries to abuse this control to escalate their privileges to code execution (with
the privileges of the app). In the past, exploiting such vulnerabilities was
extremely device dependent and required a lot of tinkering.
We explored this attack vector in depth and tried to assess if it can be
exploited in a more generic way by attacking the Android runtime itself.
In our Counterfeit Art paper we
highlight the risk of this attack vector.
Our key idea is that we target data structures that are used by the Android
runtime (ART) and modify it in ways that give us control over the instruction
pointer to execute arbitrary code.
Our exploitation technique targets the app image file that is writable by the
application itself. We abuse this over privilege to modify the internal data
structures and turn it into an exploitation primitive.
To demonstrate the feasibility of this modification we present two case studies
for both a local and a remote attacker on common Android apps that are prone to
file overwrite vulnerabilities.
Our goal of this research was to demonstrate the power of arbitrary file
overwrites and to highlight the risk app developers are taking when not
carefully vetting attacker-controlled inputs.
The main credit goes to Rokhaya-Diamil Fall and Philipp Mao who have been
closely working on this project.
Proudly powered by Pelican , which takes great advantage of Python .
The theme is by Smashing Magazine , thanks!