RCE in Adobe Acrobat Reader for Android (CVE-2021-40724)
analysis: https://hulkvision.github.io/blog/post1/

If your PC lags while using Android studio, use your terminal to launch it with the following arguments
JAVA_OPTS="-Xmx4g" /path-to-your-launch-script eg /user/local/android-studio/bin/studio.sh
That will allocate a 4Gb's heap in ram for android studio,,,if you have more ram, you can play around with that number for better perfomance eg -Xmx6g ,,,blah blah...happy coding 🥳🥳 #AndroidTricks

IOMobileFrameBuffer vulnerability in iPhone 6s and later (until iOS 15.3) has been actively exploited (CVE-2022-22587)

Impact: A malicious application may be able to execute arbitrary code with kernel privileges. Apple is aware of a report that this issue may have been actively exploited
https://support.apple.com/en-us/HT213053

Abusing Facebooks Call To Action to launch internal deeplinks
https://www.ash-king.co.uk/blog/abusing-Facebooks-call-to-action-to-launch-internal-deeplinks

Password:APToll JDKversion:11
All leaks sent are to be used at owners own risk

Intresting 🙂

https://youtu.be/a1vyt6iWmS4

detailed write up

https://vul-360-net.translate.goog/archives/217?_x_tr_sl=zh-CN&_x_tr_tl=en&_x_tr_hl=en-GB&_x_tr_pto=nui,sc

remote root on google pixel using two bugs

Typhoon Mangkhut Blackhat presentation slides

,,,,

Dirty Pipe temporary root exploit for Android (Pixel 6)
https://github.com/polygraphene/DirtyPipe-Android

Step-by-step guide to reverse an APK protected with DexGuard using Jadx
https://blog.lexfo.fr/dexguard.html

[Beetlebug Android CTF] an open source insecure Android app with CTF challenges for Android Penetesters and Bug Bounty hunters
https://github.com/hafiz-ng/Beetlebug

Android Pentesting Setup On Macbook M1

https://magarajay538.medium.com/android-pentesting-setup-on-macbook-m1-d2f1f0a8db4b

RTLO Injection URI Spoofing in mobile apps (CVE-2020-20093; CVE-2020-20094; CVE-2020-20095; CVE-2020-20096)
Affects all recent distributions of iOS iMessage, WhatsApp, Instagram, and Facebook Messenger as of 2019.8.15.
The user interface does not properly represent critical information to the user, allowing the information to be spoofed. This is often a component in online scams, phishing and disinformation propagation.
https://github.com/zadewg/RIUS

RCE vulnerability found in Qualcomm/MediaTek chips would allow attacker to gain control over a user's multimedia data, including streaming from a compromised machine's camera (CVE-2021-0674, CVE-2021-0675, CVE-2021-30351)

Exploitation: A threat actor could have sent a song (media file) and when played by a potential victim, it could have injected code in the privileged media service. The threat actor could have seen what the mobile phone user sees on their phone.
https://blog.checkpoint.com/2022/04/21/largest-mobile-chipset-manufacturers-used-vulnerable-audio-decoder-2-3-of-android-users-privacy-around-the-world-were-at-risk/

Samsung Flow - Any App Can Read The External Storage CVE-2022-28775
A rogue application could use this issue to read contents on the device's external storage without requiring the proper Android permissions
https://labs.f-secure.com/advisories/samsung-flow-any-app-can-read-the-external-storage/