CVE-2019-15350

CVE-2019-15350 describes a critical vulnerability in Tecno Camon Android devices (TECNO/H622/TECNO-ID5b:8.1.0/O11019/G-180829V31) stemming from a pre-installed app, com.lovelyfont.defcontainer. This app contains an exported service that allows any co-located application, even those with zero permissions, to dynamically load and execute arbitrary Dalvik Executable (DEX) files with system privileges. The vulnerability has a CVSS score of 7.8 (High), indicating a local attack vector with low complexity and no user interaction required, leading to high impacts on confidentiality, integrity, and availability. While there is no evidence of active exploitation, Metasploit, Nuclei, or ExploitDB modules, or significant community discussion, the potential for a malicious app to gain extensive control over the device, including accessing sensitive data, performing factory resets, and installing keyloggers, remains a significant risk.