1-click MMI execution in Android

Karan Saini shows that Android apps holding CALL_PHONE can run carrier MMI/USSD codes without user confirmation, demonstrates one-tap call-forwarding registration from a Chrome link through the ACR Phone dialer's browsable intent, and notes how Android 17 masks the calling app's identity, with a disclosure timeline for the vendor and Google.

Research · Security · Android · Vulnerability Research

How we found 24 Android vulnerabilities using our open source AI security agent

GitHub Security Lab explains the targeted AI taskflows behind 24 Android findings, the bugs they uncovered, and how to run the same open-source Taskflow Agent on your own app.

Research · Security · AI · Android · Open Source

2026 DeGoogle Mobile Telemetry Study: 72-Hour Packet Capture Dataset

An empirical 72-hour Wireshark capture comparing idle stock Pixel Android to GrapheneOS finds ~348 outbound Alphabet requests per hour on stock versus near-zero without Google services, with a public CC BY 4.0 CSV.

Research · Privacy · Security · Android · Research

Android NAT-T Keepalive Offload Bypasses VPN Lockdown: Device-Class Exposure Across Most Android 12+ DevicesTechnical report on Android VPN lockdown bypass via NAT-T keepalive offload.

Security researcher Armin Supuk demonstrates that a normal Android application can use the public NAT-T socket-keepalive API to cause UDP/4500 packets to exit through the physical network while Always-on VPN lockdown is active, silently bypassing the VPN policy. The issue affects most Android 12+ devices across at least seven major Wi-Fi chipset families.

Research · Android · Security · VPN · Networking