Binder in the kernel in Android prior to 2016-10-05 on Nexus devices allows malicious users to obtain sensitive information via a crafted application, aka internal bug 30768347.
Source: bugschromiumorg/p/project-zero/issues/detail?id=889
The interaction between the kernel /dev/binder and the usermode Parcelcpp mean
that when a binder object is passed as BINDER_TYPE_BINDER or BINDER_TYPE_WEAK_BINDER,
a pointer to that object (in the server process) is leaked to the client process
as the cookie value This leads ...
Vulmon