# Exploiting memory corruption vulnerabilities on Android

PayPal Android apps deserialized attacker-controlled class names via ParcelableJsonWrapper, enabling memory corruption and leaking account data through intent reflection.

- Payout: unconfirmed
- Severity: high
- Program: Paypal
- Credited: Oversecured
- Disclosed: 2021-04-30
- Write-up quality: 8/10
- Original: https://blog.oversecured.com/Exploiting-memory-corruption-vulnerabilities-on-Android/
- Library page: https://bugbountylibrary.com/r/blog%3Ablog-oversecured-com-exploiting-memory-corruption-vulnerabilities-on-android
- Tags: domain:mobile impact:data-leak impact:pii-leak kind:bounty platform:blog sev:high tech:android technique:chained technique:source-review vuln:deserialization vuln:memory-corruption

**Target:** Android app exported activities and Parcelable/JSON deserialization
**Root cause:** ParcelableJsonWrapper accepted attacker-controlled className and JSON, letting Gson-style parsers instantiate arbitrary classes like VirtualRefBasePtr with attacker-set native pointers; reflection also populated sensitive fields before constructor ran.
**Steps:**
1. Identify exported activity that auto-deserializes intent extras (e.g. TouchActivity).
2. Reimplement com.paypal.android.p2pmobile.common.utils.ParcelableJsonWrapper in attacker app with same CREATOR/writeToParcel.
3. Send intent with extra `evil` = ParcelableJsonWrapper("com.android.internal.util.VirtualRefBasePtr", "{'mNativePtr':3735928551}") to trigger memory corruption.
4. For data leak, send ParcelableJsonWrapper("com.paypal.android.foundation.presentation.state.AuthRememberedStateManager","{}") to SinglePaymentNativeCheckoutActivity via startActivityForResult.
5. Activity returns getIntent().getExtras() via setResult(); read leaked account state from returned Parcelable.
**How found:** Code review of PayPal apps for Parcelable classes wrapping JSON parsers with attacker-controlled class names; then searched for exported activities that auto-deserialize extras and activities that return intent extras via setResult.
**Exploitation:** Malicious app crafts ParcelableJsonWrapper with arbitrary class name and JSON, passes it as intent extra to exported PayPal activity; deserialization instantiates the class, either corrupting memory via native pointer or populating sensitive fields, then the activity echoes extras back via setResult for exfiltration.
**Escalation:** Chained arbitrary-class deserialization with an activity that reflects intent extras back to caller, converting a crash/memory bug into account data disclosure.
**Insight:** Look for Parcelable wrappers that store a className string plus JSON and feed it to Gson/Jackson; then hunt for exported activities that both auto-deserialize extras and echo getIntent().getExtras() back through setResult() to turn deserialization into data exfiltration.