Mobile Hacking Labs
StreamBox
StreamBox is a small APV (Advanced Professional Video) player for Android. The video player directly plays shared clips on arrival.
The player contains a vulnerability CVE-2026-28618, It is the same bug class, in the same decoder, as CVE-2026-0006, the zero-click APV RCE exploited in the wild earlier this year.
Objective
Remotely exploit this app by sharing a malicious APV clip.
Skills Required
- Reverse Engineering: Proficiency in disassembling and analyzing compiled code.
- Exploitation of low level memory corruption bugs
