MMS Exploit Part 4: MMS Primer, Completing the ASLR Oracle
Summary: Project Zero's Mateusz Jurczyk, in Part 4 of a series on exploiting a Samsung Qmage image codec, set up a PC-based MMS test rig using two SIM cards, a licensed NowSMS server, a Galaxy A50 as modem and a Galaxy Note 10+ as receiver. He then used the MMS delivery report feature, which Samsung Messages supports but Google Messages does not, to get feedback on whether the target app crashed, completing the ASLR oracle needed for a remote zero-click attack.
What you should know: The attack path relies on a protocol feature most users never touch: a delivery report that tells the sender whether the target phone's Messages app survived the message, turning a one-way MMS into a crash oracle for defeating Android ASLR.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026