Security on Alessandro Sangiorgi — GPU Performance Engineer

FLAG_MUTABLE PendingIntent in DeviceAsWebcam Allows Foreground Activity Hijack via fillIn() Injection

Sat, 18 Apr 2026 00:00:00 +0000

I reported a vulnerability in AOSP’s DeviceAsWebcam service where a FLAG_MUTABLE PendingIntent is used as the foreground notification’s contentIntent. An attacker app with user-granted NotificationListenerService access can extract the PendingIntent, inject arbitrary intent fields via fillIn(), and force-launch the system-UID DeviceAsWebcamPreview activity in the foreground — overlapping whatever the user was doing. The report was submitted on March 19, 2026.

The Vulnerable Code

The vulnerability is in DeviceAsWebcamFgService.java (line 134). The preview activity intent is created with only the component set — no action, no data, no extras, no flags, no categories:

Blocking WiFi De-Auth Attacks in the Kernel with eBPF and XDP

Tue, 07 Apr 2026 00:00:00 +0000

802.11 de-authentication attacks are one of the oldest and cheapest WiFi denial-of-service techniques. An attacker sends forged de-auth management frames to disconnect clients from an access point — aireplay-ng sends 128 per attack command (64 directed at the AP, 64 at the client). Despite being a known problem for over two decades, the main defense is still 802.11w (Protected Management Frames), which requires both AP and client support and still degrades under high-rate floods.

Intercepting Android's ManagedProvisioning: A PendingIntent Vulnerability in AOSP

Mon, 06 Apr 2026 00:00:00 +0000

I found and reported a vulnerability in Android’s ManagedProvisioning component — the system app responsible for setting up enterprise-managed (work) profiles. The bug allows any unprivileged third-party app to intercept a privileged provisioning callback, leaking install timing, session metadata, and in some cases package details — all without any special permissions.

Google acknowledged the report, logged it for potential remediation, and classified it as low severity. Here’s the full breakdown.