Android InCallController serviceClassExists Logic Error Local Privilege Escalation

This is a 37-file Android Gradle proof-of-concept repository for CVE-2026-49881, a logic flaw in Android Telecom's InCallController class-existence check. The primary exploit code is Kotlin: MainActivity registers a transactional PhoneAccount and creates an incoming call associated with a declared InCallService whose implementation is intentionally absent. EvilFactory is configured as the application's AppComponentFactory; when Telecom/system_server attempts to resolve the missing component, the factory's instantiateClassLoader method executes under system_server rather than the app UID. After demonstrating execution with `id` and a stack-trace log, EvilFactory retrieves a second APK from the app's exported provider, writes it to /data/system/s.apk, and uses reflective PackageManagerService access supplied by RPMS.kt. It changes android.uid.system signing history to include the attacker's certificate with shared-user-ID capability, flushes package settings, uninstalls the original package, and installs the system-flavor APK. The system flavor's manifest specifies android:sharedUserId="android.uid.system" and android:process="system". The payload then marks the package blocked from uninstall and launches its activity. Cleanup code reverses the block, clears the modified past-certificate field, and uninstalls the app. The project contains the Android application module under TLPE/, manifests for normal and system product flavors, five Kotlin source files, standard Android resources, Gradle wrapper/build configuration, and build.sh. build.sh builds the system flavor first, embeds it as app/src/poc/assets/system.apk in the PoC flavor, and produces poc.apk. No remote command-and-control, external exploitation target, or network communication is present; the attack is entirely local and targets Android platform services.

LSPromise is a 33-file Android Gradle project implementing a local privilege-escalation chain rather than a remote exploit or detection utility. The Java APK registers a self-managed Telecom account, ConnectionService, and InCallService whose CLASS_EXISTENCE_CHECK metadata causes Telecom to load the application's AppComponentFactory. MyAppComponentFactory invokes Shellcode during this privileged class-loading event. Shellcode detects system_server execution, reflects into ActivityManagerService to schedule its receiver inside com.android.networkstack.process (UID 1073), loads libexp there, and returns a Binder controller to the UI through an explicit EVIL broadcast. MainActivity exposes staged native actions and copies KernelSU's libksud.so to the app data directory as ksud. The native component consists primarily of exp.c, elf_parser.c, and stage1.S. exp.c builds the DirtyFrag page-cache overwrite primitive through local NETLINK_XFRM/IPsec and loopback traffic operations, patches crash_dump64, libc.so, libc++.so, and the vendor Stagefright bufferpool library, then triggers init using an orphaned-process condition. The AArch64 hooks transition into vendor_modprobe, load the replaced vendor library as a kernel module with finit_module, and execute KernelSU. shelld.c is a separate abstract-UNIX-socket command relay/helper; it is present in the repository but is not included in the shown CMake target. The hard-coded device paths, Android internals, and KernelSU dependency make this an operational, device-specific exploit chain.