The detail of the vulnerability please refer to description.pdf My sad story about this bug: I repoted this issue to ZDI last March, at the beginning, they said they couldn't reproduce it in the latest Android, after half a month comunication, they decided not to pursue acquisition of the bug. Holded this bug for a long time, and I reported it to Google at Aug 21, 2015, but it become a duplicated issue. https://code.google.com/p/android/issues/detail?id=183414 the funny thing is it's duplicated with the issue reported at Aug 23, 2015, which is ANDROID-23540426 https://groups.google.com/forum/#!topic/android-security-updates/GwZn7sixask I don't know how the hell Google calculated the data, just release the PoC for fun.