libretro RetroArch: Code injection through exported Android activity
RetroArch for Android (com.retroarch) version 1.22.2 exports an activity that accepts a file path from another app and loads that file as a native library. A locally installed app without any permissions can therefore make RetroArch copy and load attacker-supplied code, which runs with the uid and privileges of RetroArch. The official CVE record rates exploitation as possible through a proof of concept and automatable, but the NVD analysis is pending and the CVSS score of 9.8 is not yet confirmed by NVD.
libretro · RetroArch
