# Huawei Theme Manager Arbitrary Code Execution

Huawei Theme Manager's ucdlockscreen engine loads attacker-specified Java classes from theme APKs without signature validation, giving code execution in a privileged process.

- Payout: Research
- Severity: high
- Program: Huawei EMUI
- Write-up by: Doyensec
- Disclosed: 2023-07-25
- Write-up quality: 8/10
- Original: https://blog.doyensec.com/2023/07/26/huawei-theme-arbitrary-code-exec.html
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-doyensec-com-2023-07-26-huawei-theme-arbitrary-code-exec-html
- Tags: area:mobile domain:mobile impact:integrity impact:privesc kind:research platform:research sev:high technique:reverse-engineering technique:source-review vuln:privilege-escalation vuln:rce

**Target:** Huawei Theme Manager / com.huawei.ucdlockscreen lockscreen engine
**Root cause:** The ucdlockscreen dynamic engine loads classes named in the theme's ext.properties (e.g. com.huawei.nova.ExtensionJarImpl from a bundled APK) at runtime without validating their signatures, unlike the theme APK itself which is signature-checked.
**Steps:**
1. Build a .hwt theme archive containing unlock/theme.xml specifying the ucdscreenlock dynamic engine and an unlock/ext.properties naming a class and APK to load.
2. Package attacker code as com.huawei.nova.ExtensionJarImpl inside NOVA6LockScreen2019120501.apk within the theme.
3. Install the theme on the EMUI device; HwThemeManager/SystemUI loads the theme and the ucdlockscreen engine dynamically loads the attacker class.
4. Attacker code executes in the com.huawei.android.thememanager process with ~200 Android/Huawei permissions.
5. For the legacy bypass: embed a /data/themes/0/unlock/ucdscreenlock/error file referencing an older version plus a fictitious package name in ext.properties to force legacy theme support and bypass checks on EMUI 9.1.
**How found:** Researchers targeted the Themes Manager because system-wide customization requires elevated privileges. They noted signature checks on theme APKs were sound, but observed via logcat that com.huawei.ucdlockscreen dynamically loads additional classes at runtime, then inspected the .hwt archive structure and theme.xml/ext.properties to find the unvalidated class-loading path.
**Exploitation:** Attacker delivers a malicious .hwt theme (via theme gifting deep link `hwt://www.huawei.com/themes?type=33&id=0&from=AAAA&channelId=BBB` or a QR/link triggering HwThemeManager) requiring user install; the loaded class runs in the privileged Theme Manager process, granting ~200 permissions and enabling intents requiring huawei.android.permission.HW_SIGNATURE_OR_SYSTEM, potentially escalating to system-level code execution and rooting.
**Escalation:** Chaining the privileged process's HW_SIGNATURE_OR_SYSTEM-permission intents to reach system-level code execution; also physical-access downgrade of ucdlockscreen.apk to the vulnerable version on latest EMUI.
**Insight:** When a privileged app validates the signature of the outer package, check whether it later dynamically loads code (DexClassLoader/reflection) named by attacker-controlled config inside that package — the inner classes often skip validation. Also probe backward-compatibility version markers (like an error file selecting legacy mode) as a bypass for patched loaders.