OATmeal on the Universal Cereal Bus: Exploiting Android phones over USB

Summary: Project Zero's Jann Horn described a chain that let a malicious USB device take over a locked Android phone, tested on a Pixel 2, by exploiting two bugs fixed as CVE-2018-9445 (patch level 2018-08-01) and CVE-2018-9488 (patch level 2018-09-01). The first bug let an unescaped filesystem label control the UUID string blkid returned to vold, and the second let that UUID drive a directory traversal in the mount path, so a crafted stick could mount a FAT filesystem outside /mnt/media_rw.
Why it matters: Android keeps the file-decryption keys in kernel memory after the first unlock, so a locked phone is not a protected phone: an attacker with a USB stick and a Raspberry Pi Zero W could mount over /data and hand off to com.android.externalstorage to exfiltrate external storage.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2018-9445 CVE-2018-9488
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026