CVE-2026-68928: Acode Android Editor RCE Vulnerability

CVE-2026-68928 Overview

CVE-2026-68928 affects Acode, a text and code editor for Android, in versions from 1.11.6 through 1.12.6. The com.foxdebug.acode.rk.exec.terminal.TerminalService component is declared as an exported Android service without a binding permission. The service does not verify the identity of callers before executing commands. Any installed application on the device can bind to the service, send an MSG_EXEC message with an attacker-controlled cmd value, and have that value passed to ProcessBuilder with sh -c inside the Acode process UID. This grants a zero-permission local application access to Acode's private data, remote credentials, Storage Access Framework grants, and runtime-approved permissions. The maintainers fixed the issue in version 1.12.7.

Critical Impact
A local Android app with no declared permissions can execute arbitrary shell commands inside Acode's UID and steal any data the editor can access.

Affected Products

Acode Android editor versions 1.11.6 through 1.12.6
com.foxdebug.acode.rk.exec.terminal.TerminalService exported service
Acode terminal plugin defined in src/plugins/terminal/plugin.xml

Discovery Timeline

2026-09-18 - CVE-2026-68928 published to NVD
2026-09-24 - Last updated in NVD database

Technical Details for CVE-2026-68928

Vulnerability Analysis

The vulnerability is a missing authorization on an exported Android service, categorized under [CWE-749]: Exposed Dangerous Method or Function. Acode's terminal plugin registers TerminalService with android:exported="true" and defines no android:permission attribute. The service handler in src/plugins/terminal/src/android/TerminalService.java processes an MSG_EXEC message and passes the caller-supplied cmd string directly to ProcessBuilder invoked with sh -c. The service does not call Binder.getCallingUid() or validate the caller package. Any application resident on the device can bind to the messenger and issue commands that execute inside Acode's process. Commands inherit every runtime permission the user has granted to Acode, including storage, network, and Storage Access Framework document grants. Attackers can exfiltrate SSH keys, FTP credentials, and source code that Acode manages.

Root Cause

The root cause is the combination of two configuration flaws in the terminal plugin. First, the service is exported to all applications on the device. Second, the request handler trusts the payload and does not authenticate the sender before invoking a shell. Neither a signature-level permission nor a caller UID check gates the MSG_EXEC handler.

Attack Vector

A malicious application declares no permissions in its manifest. It creates an Intent targeting com.foxdebug.acode/com.foxdebug.acode.rk.exec.terminal.TerminalService, calls bindService, obtains the Messenger, and sends an MSG_EXEC message whose bundle contains an attacker-controlled cmd string. Acode executes the string with sh -c inside its own UID. User interaction is required only to install the attacker app; no interaction is required at attack time.

xml

<!-- Patch applied in src/plugins/terminal/plugin.xml -->
                 android:name="com.foxdebug.acode.rk.exec.terminal.TerminalService"
                 android:enabled="true"
                 android:foregroundServiceType="specialUse"
-                android:exported="true" />
+                android:exported="false" />

Source: GitHub Commit 0a5237a

Detection Methods for CVE-2026-68928

Indicators of Compromise

Unexpected child processes of the Acode package (com.foxdebug.acode) invoking /system/bin/sh -c with commands unrelated to editor operations.
New or modified files in Acode's private data directory /data/data/com.foxdebug.acode/ created outside of user editing sessions.
Outbound network connections initiated by the Acode process to unfamiliar hosts, indicating credential or source-code exfiltration.
Installed third-party applications that declare no permissions yet issue bindService calls targeting TerminalService.

Detection Strategies

Audit installed apps for manifests that reference com.foxdebug.acode.rk.exec.terminal.TerminalService as a bind target.
Use mobile threat defense tooling to flag unauthorized IPC to editor or IDE applications.
Review Acode's version on managed devices; treat any build below 1.12.7 as vulnerable.

Monitoring Recommendations

Enable Android logcat collection on test devices and search for TerminalService bind events attributed to non-Acode UIDs.
Monitor MDM inventory feeds for Acode versions 1.11.6 through 1.12.6 and alert on downgrade attempts.
Track process ancestry telemetry for editor apps spawning shell interpreters during idle periods.

How to Mitigate CVE-2026-68928

Immediate Actions Required

Upgrade Acode to version 1.12.7 or later on every Android device where the editor is installed.
Remove Acode from devices that cannot be upgraded, especially devices holding SSH keys, cloud tokens, or production source code.
Revoke and rotate any credentials that Acode has stored or accessed, including FTP, SFTP, and Git tokens.

Patch Information

The fix ships in Acode v1.12.7. The patch sets android:exported="false" on TerminalService in src/plugins/terminal/plugin.xml, blocking cross-application binding. See the GitHub Security Advisory GHSA-wm94-wp33-43gx, the pull request #2442, and the v1.12.7 release notes.

Workarounds

Uninstall Acode until the update to 1.12.7 can be applied, since no runtime configuration flag disables the exported service in vulnerable versions.
Restrict device profiles to trusted app sources and block sideloading through MDM policy to reduce the population of potentially malicious binders.
Isolate development credentials by using per-project SSH keys and short-lived tokens that limit blast radius if Acode's private storage is read.

bash

# Verify installed Acode version on a connected Android device
adb shell dumpsys package com.foxdebug.acode | grep versionName

# Force upgrade or removal if version is below 1.12.7
adb uninstall com.foxdebug.acode