High severity8.4OSV Advisory· Published Nov 4, 2024· Updated Jun 17, 2026
CVE-2024-48336
CVE-2024-48336
Description
The install() function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app and escalate privileges to root via a crafted package, aka Bug #8279. User interaction is not needed for exploitation.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <27007
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.