The engine sizes a buffer from one field in the font and copies data based on another. A crafted font makes them disagree, which gives a two-byte heap overflow. We used it to corrupt a function pointer.
The service rendered uploaded PDFs on the server, and PDFs can load remote resources. That was enough to reach internal endpoints, including the cloud metadata service.
An exported activity forwarded any intent it received, which gave other apps access to components that were supposed to be private. We cover the bug, the fix, and a lint rule that catches it.
The pairing counter resets on every reboot, so the same nonce gets used twice. With two captured handshakes, the session key can be recovered.
A race between two rename calls drops a reference one time too many. We explain the race and how we made the exploit reliable on stock hardware.
A glitch at the right moment skips the signature check in the boot ROM. Most of the work was finding the timing. The bug is in ROM, so it cannot be patched.
Getting to code execution took eleven attempts. We wrote up the failed ones as well, since they show where the engine is actually hardened.
A step by step walkthrough, from how the JIT works to a working read/write primitive. Everything in it can be reproduced on a laptop.
The harness generator we use internally, cleaned up and released under the MIT license.
What went well, what didn't, and a disclosure we handled badly.
