Framework path traversal sandbox escape

## description

Path traversal in the Android framework allows an attacker app to access files outside its sandbox in protected directories such as Android/data and Android/obb.

## impact

Cross-app data exfiltration. Active exploitation reported by Google.

## mitigation

Apply November 2024 Android security patch level.

## proof of concept

// Path traversal payload
File f = new File(ctx.getExternalFilesDir(null),
  "../../../Android/data/com.victim/files/secret.db");
FileInputStream in = new FileInputStream(f);

## downloads

## references

• Android Bulletin 2024-11