Acode CVE-2026-68928

Requires a second, attacker-controlled Android application already installed on the same device as a vulnerable Acode build (1.11.6 through 1.12.6); that app needs NO Android permissions of its own. The specific enabling condition is Acode's terminal plugin declaring TerminalService with android:exported="true" and no binding permission, combined with TerminalService.java not verifying the caller's identity - so any app can bind it and send MSG_EXEC. Limiting factors: exploitation is purely local (no network/remote vector), the victim must have installed both Acode and the malicious app, and updating to Acode 1.12.7 (which sets exported="false") fully closes the exposure. Impact is bounded to whatever Acode's UID can reach - its private data, stored remote credentials, SAF grants, and granted runtime permissions.

This is a legitimately high-priority local privilege/data-exposure flaw despite no EPSS, KEV, or public POC being present. The CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H = 8.6) is internally consistent with the description: exploitation is LOCAL (a malicious app must be co-resident on the device), requires no privileges in Acode (PR:N - a zero-permission Android app suffices), and crosses a trust boundary (S:C - the attacking app escapes its own sandbox to execute in Acode's UID). The fix is confirmed by vendor PR #2442 and commit 0a5237a3, which simply flip android:exported from true to false, corroborating the root cause (CWE-749, exposed dangerous method). The one signal to weigh carefully is UI:R: the vendor sets User Interaction Required, but the description states the command runs 'without additional interaction at attack time,' so the 'interaction' is really the victim installing the malicious app once - not per-attack consent. No exploitation-status data (EPSS/KEV/POC) is provided, so real-world exploitation is unproven; the risk is high impact but gated by the local-access precondition, making it a targeted/opportunistic concern (malicious or trojanized companion apps) rather than a mass-exploitable remote bug. SSVC-style: exploitation=none observed, automatable=no (requires local co-residence), technical impact=total (arbitrary command execution in Acode's UID).

A user installs any innocuous-looking, zero-permission app alongside Acode. That app silently binds Acode's exported TerminalService, sends an MSG_EXEC message with an attacker-controlled command, and Acode runs it via ProcessBuilder ('sh -c') inside its own UID - exfiltrating Acode's private files, cached remote/SSH/FTP credentials, and Storage Access Framework grants. No public exploit code is identified at time of analysis, but the primitive is trivial to reproduce from the advisory and one-line plugin.xml diff.