Android Extra Field Vulnerability Spotted in the Wild
Summary: Twenty days after the Android Security Squad first reported the Extra Field vulnerability, also called Chinese Master Keys, Cisco Talos spotted it in the wild in a sample named Arctic.apk (MD5: C9F4C62521C04B8ADD796A1D5CEE08B0), which carries a nested APK called DoubleRainbow.apk (MD5: 1B14AD438375E6C25F645A855828D78F) that contains the exploit. DoubleRainbow.apk is not malware - it is built to root the Kobo Arc tablet, injecting a custom classes.dex padded with a 2599-byte 'LOLOLOL...' string to match the replaced file's size, then running wifiScript.sh to copy su and Superuser.apk into /system and uninstall com.kobo.statusbar.
What's compelling: The sample is benign, but it proves the Extra Field vulnerability gives root access easily enough that Talos expects it and Master Keys to become common in Android malware - so the same technique that rooted a Kobo tablet is now a reusable tool for anyone who wants elevated privileges on your fleet.
Read the original at Cisco Talos ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026