Google has provided a patch (commit 02751bc6) that replaces the vulnerable recycleParcel() method with parcel.destroy(), which properly invalidates the native pointer and prevents the object from returning to the reusable pool.

Attack Chain

1. Attacker triggers NotificationManager.notify() with specially crafted bundles containing a mix of lazy and eager entries.
2. The system_server parses the bundle, creating LazyValue shells that reference the internal Parcel.
3. BaseBundle.recycleParcel() is invoked, returning the Parcel buffer to the sOwnedPool while the LazyValue retains a dangling reference.
4. Attacker performs a heap spray to allocate memory that overwrites the recycled Parcel buffer.
5. Attacker forces an unwrap operation on the LazyValue, causing it to read the attacker-controlled data from the overwritten buffer.
6. The system encounters an anomaly or invalid state due to the manipulated data, providing a primitive for further exploitation.

Impact

Successful exploitation allows for heap memory manipulation within the system_server (UID 1000). While the provided Proof-of-Concept currently validates the lifecycle UAF anomaly (Level 1), it confirms the structural vulnerability in the AOSP BundleRecyclingTest.java suite. Theoretical impact includes Type Confusion and remote code execution.

Recommendation

• Inventory all Android devices running versions 14.0, 15.0, and 16.0.
• Verify if systems have received the security update containing commit 02751bc6 or the associated monthly security patch.
• Monitor for anomalous application behavior involving the NotificationManager or system_server process crashes associated with BadParcelableException.
• Use the PatchDetector logic described in the PoC to audit pre-patch environments by verifying the existence of the recycleParcel method and the status of Parcel.destroy().