Executive brief
Acode is a code editor for Android devices. Versions 1.11.6 through 1.12.7 contain a flaw where an unprotected system service can be accessed by any installed app to execute arbitrary commands with Acode's permissions, including access to stored credentials and files. This allows a malicious app to steal data or execute commands without asking the user for permission.
Technical details
The TerminalService is exported without a binding permission and lacks caller verification, allowing any app to bind and send MSG_EXEC commands that are passed to ProcessBuilder. An unprivileged local attacker can execute arbitrary shell commands within Acode's process context, gaining access to the app's private data, stored credentials, Storage Access Framework grants, and runtime permissions without user interaction.
Affected products
- Acode Foundation Acode 1.11.6 to 1.12.7
Timeline
- 2026-09-18: disclosed
- 2026-07-03: patched: Fixed in version 1.12.7