Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
adjust/android_sdk
master @ b31ee27
6
Fixes
0
CVEs
HIGH
Peak severity
66.7%
Coverage
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
Adjust/plugins/sdk-plugin-webbridge/src/main/assets/adjust.js: most-fixed (2 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Two separate fixes were needed to prevent unauthorized web pages from invoking native SDK methods and intercepting callbacks, indicating a persistent trust-boundary weakness in the bridge.
Insecure Deserialization: ObjectInputStream.readObject() was used without a class allowlist, enabling arbitrary object injection and potential RCE.
Privilege Escalation: Using checkCallingOrSelfPermission allowed a local app to bypass permission checks by passing its own UID, leading to privilege escalation.