Beyond Sensitive APIs: Detecting Access Control Flaws at Sensitive Callsites in Android Firmware

Abstract

Existing studies of vulnerable pre-installed Android apps identify dangerous behavior by checking whether an app invokes an API from a predefined set of security-sensitive APIs. These sets usually exclude generic APIs to avoid false positives; unfortunately, this misses a class of vulnerabilities in which a generic API, such as a database read, appears benign in general but becomes security-sensitive when operating on protected data, yet is left without sufficient access control. While this class of vulnerabilities appears addressable via access control analysis, existing studies focus only on the presence of checks, not on whether those checks enforce sufficient protection for the operation at a given callsite. In this work, we propose Callix, which first assesses callsite sensitivity by jointly analyzing the invoked API functionality and the data involved in the operation, then recovers each security check on the execution path as an explicit security property, and finally introduces the notion of restriction context to decide whether these checks are sufficient for the identified sensitive operation. We evaluated Callix on 1,750 distinct pre-installed apps from the 10 top-tier Android vendors as of 2025. In total, Callix discovered 819 vulnerable paths across these vendors, 42.1% of which allow reading or modifying private user data through generic database operations. Manual validation of a random 60% sample shows a precision of 95.1%. Many of our findings have been confirmed and rewarded through vendor bug bounty programs.