Description

Detects Fragment Injection vulnerabilities in Android applications where fragments can be dynamically loaded without proper validation. This security flaw could allow attackers to inject malicious fragments, potentially leading to code execution or data theft.

Detection Strategy

• Scans for dynamic fragment loading in application code using methods like loadFragment() or instantiate()

• Checks if the application uses fragment class names from untrusted sources (like Intent data) without validation

• Examines fragment transaction handling to identify cases where fragment class names are processed insecurely

• Triggers when fragment instantiation occurs with user-controlled input without proper class validation