LSPosed

We discovered a privileged process arbitrary code execution vulnerability in Android 17. This vulnerability was patched in Android 17 QPR1 but was not included in any security bulletin. Combined with the dirty frag vulnerability (CVE-2026-43284), we achieved…

We discovered a privileged process arbitrary code execution vulnerability in Android 17. This vulnerability was patched in Android 17 QPR1 but was not included in any security bulletin. Combined with the dirty frag vulnerability (CVE-2026-43284), we achieved full root privilege escalation on Android 17.0. The DirtyFrag vulnerability was disclosed 3 months ago but is still exploitabe, because Google has delayed the release frequency of vulnerability patches, changing from monthly to quarterly security bulletins. In the AI ​​era, this behavior is completely incomprehensible. A large number of devices in the Android ecosystem are vulnerable to attacks due to the vulnerability details leaked in the Pixel system; even Pixel devices not participating in the beta program are not immune. Therefore, we used two "already patched" vulnerabilities to demonstrate full rooting on Google Pixel 10 with the latest patches as a warning, urging Google to change its practices and release vulnerability patches promptly.

v2.1.1 新增 - 最低支持版本提升至 Android 9（API 28） - 高级隐藏功能现可支持 A12+ - 允许一键清空已选作用域 改进 - 优化安全模式对 System UI 的检测阈值 - 恢复管理器中的模块数量徽标 - 改进错误报告发送流程 修复 - 修复部分情况下无法启动守护进程的问题 - 修复 XposedHelpers.findField API 行为 - 修复 Android 17 下服务连接接口不兼容的问题 - 修复模块详情页弹出菜单显示层级异常的问题 - 修复 Markdown 样式在部分页面中显示异常的问题 Added - Raised the minimum supported version to Android 9 (API 28) - Advanced hiding is now supported on Android 12 and above - Added an option to clear all selected scope apps Improved - Optimized the System UI detection threshold in safe mode - Restored the module count badge in the manager - Improved the error report submission process Fixed - Fixed an issue that could prevent the daemon from starting - Fixed the behavior of the XposedHelpers.findField API - Fixed service connection incompatibility on Android 17 - Fixed incorrect popup menu layering on the module details page - Fixed Markdown styles being displayed incorrectly on some pages

Successfully root my K90PM using CVE-2026-43499

v2.1.0 新增 实现 libxposed API 102 适配 Android 17 QPR1 Beta 4 维护 原计划 2.1.0 废弃 New XSharedPreferences 推迟到 2.2.0，强烈建议 legacy 模块尽快迁移到 libxposed 改进 大幅提升被 hook 方法的性能 优化还原内联钩子逻辑 优化 dex 优化器包装的挂载逻辑 优化一系列的 UI 体验 修复 修复 XposedBridge.unhookMethod 行为异常 修复了一个全局检测点 修复 TalkBack 重复朗读、未朗读勾选状态等无障碍问题 Added Implemented libxposed API 102 Adapted for Android 17 QPR1 Beta 4 Maintaince Postponed the planned deprecation of New XSharedPreferences in version 2.1.0 to 2.2.0. We strongly recommend migrating legacy modules to libxposed as soon as possible Improved Significantly improved the performance of hooked methods Optimized invalidate inline hooks logic Optimized the mount logic of dex optimizer wrapper Optimized a range of UI experiences Fixed Fixed abnormal behavior of XposedBridge.unhookMethod Fixed a global detection point Fixed accessibility issues such as TalkBack repeating text and failing to read checked items 下载 / Download

Changes since latest release: Added - Provided high-speed CDN for the module repository. If you dislike ads, please switch to backup CDN in settings - Added SystemUI safe mode Improved - Enhanced hook compatibility and performance - Improved homepage device name recognition Fixed - Fixed Android 17 QPR1 Beta 3 crash issues - Fixed a series of M3E theme-related issues - Fixed Markdown WebView reload handling issues 自上次更新以来的改动： 新增 - 提供模块仓库高速 CDN，若不喜欢广告请在设置切换备用 CDN - 新增 SystemUI 安全模式 改进 - 提升 hook 兼容性和性能 - 增强首页设备名称识别 修复 - 修复 Android 17 QPR1 Beta 3 崩溃问题 - 修复一系列 M3E 主题相关问题 - 修复 Markdown WebView 重载处理问题

libxposed API 102 is now under RFC. Please give us suggestions regarding the API design. https://github.com/libxposed/api/pull/62

libxposed API 102 snapshots are now available. Join our internal test program to get LSPosed with API 102 support so you can test it. Please note that it's NOT final so NEVER use snapshots in production. Open an issue on GitHub if you have any suggestion. Usage: add snapshot maven to settings.gradle.kts maven { url = uri("https://central.sonatype.com/repository/maven-snapshots/") mavenContent { snapshotsOnly() } content { includeGroup("io.github.libxposed") } } Use snapshot builds: compileOnly("io.github.libxposed:api:102.0.0-SNAPSHOT") implementation("io.github.libxposed:service:102.0.0-SNAPSHOT")

v2.0.3 released: Major Behavioral Changes - Legacy modules are no longer allowed to call libxposed API; modules with targetApiVersion ≥ 102 will not be allowed to call legacy API; 101 modules are unaffected New Features - Introduced Material 3 Expressive style manager - Enhanced theme-related settings to support dynamic color schemes and dark mode, and improved the display of cards, menus, bottom navigation, and dialogs Improvements - Improved log display and error logging; parsed view now correctly displays excessively long error stacks without fragmentation - Attempted to improve hook performance Fixes - Fixed an issue where scope recommendations were displayed incorrectly in some legacy modules - Fixed several issues with libxposed API implementations Removals - Removed the old MD3 manager - Removed support for the 32-bit x86 architecture v2.0.3 发布： 重大行为变更 - Legacy 模块不再允许调用 libxposed API；targetApiVersion ≥ 102 的模块不再允许调用 Legacy API，101 模块不受影响 新增 - 引入 Material 3 Expressive 风格管理器 - 完善主题相关设置，支持动态配色和深色模式，改进卡片、菜单、底部导航和对话框的显示效果 改进 - 改进日志显示和错误记录，现在解析视图能够正确显示超长错误栈而不被分片 - 尝试改进 hook 性能 修复 - 修复部分旧模块作用域推荐显示错误的问题 - 修复一些 libxposed API 实现问题 移除 - 移除旧的 MD3 管理器 - 移除 32 位 x86 架构支持 Download / 下载：

LSPosed-v2.0.2-7668-release.zip

无法规避的Magisk识别方案已经公开：https://github.com/eltavine/Duck-Detector-Refactoring/pull/22 检测方法说明和概念验证app：https://github.com/LSPosed/DirtySepolicy

Changes since last release: Added Enabled dynamic blur based on device state (e.g. power saving mode, performance class) Added collapsing for long module descriptions Added tapjacking mitigation toggle and hint Hid the "install to other user" option when the module is already installed Improved Reduced per-method callback count to limit crash propagation caused by faulty modules Ensured Xposed service is re-delivered after module updates Sent binder to daemon earlier during system boot to reduce initialization race conditions Removed the need to force stop when switching manager Updated LSPlant to fix various injection issues Updated MIUIX to address known issues Optimized memory usage during manager startup and repository loading for low-RAM devices Fixed Fixed incorrect "install to user" behavior in the new manager Fixed module configuration not being removed on uninstall Fixed rare cases where hooks were not updated after module upgrade Fixed native API loading timing for the new API Fixed excessive memory usage during manager startup and repository loading Fixed search results being obscured by the bottom bar Fixed edge-to-edge layout issues in the new manager 新增 新管理器根据设备状态（如省电模式、性能等级）动态决定是否启用模糊效果 新管理器支持折叠过长的模块描述 新增点按劫持（tapjacking）缓解开关及提示 当模块已安装时，新管理器隐藏“安装到其他用户”的选项 改进 减少每个方法的最大回调数量，降低异常模块导致的系统崩溃扩散风险 确保模块更新后重新分发 Xposed 服务 系统启动阶段更早向 daemon 发送 binder，减少初始化竞态窗口 切换管理器无需再强行停止进程 更新 LSPlant，修复多类注入与 hook 相关问题 更新 MIUIX，修复已知兼容性问题 优化管理器启动及模块仓库加载时的内存占用 修复 修复新管理器“安装到用户”选项异常 修复卸载模块时未清理配置的问题 修复模块更新后在极少数情况下 hook 未生效的问题（如更新后立即强制停止目标应用） 修复新 API 的 native API 加载时机问题 修复管理器启动及加载模块仓库时的内存占用异常 修复搜索结果被底栏遮挡的问题（窗口 inset 处理） 修复新管理器边到边布局问题

我们也同步发布了 libxposed api 101.0.1 版本，带来了更详细的行为规范和开发文档。 We also released libxposed api version 101.0.1, which brings more detailed behavior specifications and development documentation. https://github.com/libxposed/api

自 v1.9.2 以来的主要更新： 新增 - 支持 Android 8.1 至 Android 17 Beta 3 - 新增完整的 libxposed API 101 支持 - 新增 miuix 版本管理器并默认启用 - 新增可按应用配置的还原内联钩子功能 - 新增对 libxposed 相关类启用 API 调用保护 - 新增安全模式 - 新增 action.sh 支持，可从 action.sh 打开管理器 - 重构 dex2oat 包装器，支持在 Android 12+ 重新优化系统框架 - 新增 16K page size 支持 - 支持注入系统自定义 resolver 的进程 - 支持重置作用域请求设置 - 支持将日志转发至守护进程 改进 - 大幅度增强对被注入的应用的隐藏能力 - 适配新版 Android 上的反射限制与部分系统行为变化 - 改进软件包与模块解析逻辑 - 优化管理器与服务之间的通信方式，加快启动速度 - 改进 LoadedApk、类初始化 Hook、native hook 的兼容性 - 改进 system_server 相关初始化、binder 发送、异步重试与重启恢复逻辑 - 改进日志系统，提供更丰富的上下文信息，例如 UID / PID - 改进多用户支持 修复 - 修复作用域备份与恢复功能 - 修复与部分自带 LSPlant 的应用的兼容性问题 - 修复 XSharedPreferences 初始化、目录权限与目录缺失问题 - 修复部分 Hook 崩溃与稳定性问题 - 修复一些内存泄漏问题 - 修复自动取色、浏览器跳转、搜索、图标显示等多项 UI 问题 - 修复对部分 OEM 系统的多项兼容性问题 - 修复多用户、卸载后配置残留与恢复错乱问题 - 修复 system_server 重启后的状态恢复问题 - 修复目录权限错误和配置迁移异常 - 修复日志解析与打包中的一些问题 - 修复 RemoteFile 在重启后可能无法读取的问题 移除 - 移除桌面快捷方式，可通过通知、拨号盘或 action.sh 启动管理器 - 移除 Riru 支持 - 移除对 libxposed API 版本 100 的支持 Added - Support for Android 8.1 through Android 17 Beta 3 - Full support for libxposed API 101 - Added a new MIUIX-based Manager and enabled it by default - Added per-app restore inline hooks support - Added API call protection for libxposed-related classes - Added safe mode - Added action.sh support, including opening the Manager from action.sh - Refactored the dex2oat wrapper, with support for recompiling the system framework on Android 12+ - Added 16K page size support - Added support for injecting processes that use a custom system resolver - Added support for resetting scope request settings - Added support for forwarding log to daemon process Improved - Significantly improved hiding for injected apps - Adapted to reflection restrictions and system behavior changes on newer Android versions - Improved package and module parsing logic - Improved communication between the manager and the service, with faster startup - Improved compatibility for LoadedApk handling, class initializer hooks, and native hooks - Improved system_server initialization, binder delivery, async retries, and recovery after restarts - Improved logging with rich context information such as UID and PID - Improved multi-user support Fixed - Fixed scope backup and restore - Fixed compatibility issues with some apps that bundle their own LSPlant - Fixed XSharedPreferences initialization, directory permission, and missing-directory issues - Fixed various hook-related crashes and stability issues - Fixed several memory leak issues - Fixed various UI issues including dynamic color, browser launch, search, and icon display - Fixed multiple compatibility issues on some OEM ROMs - Fixed multi-user issues, stale config after uninstall, and restore inconsistencies - Fixed state recovery after system_server restarts - Fixed directory permission errors and config migration issues - Fixed several issues in log parsing and packaging - Fixed cases where RemoteFile could become unreadable after reboot Removed - Removed desktop shortcuts; the Manager can now be opened via notification, dialer code, or action.sh - Removed Riru support - Removed support for libxposed API version 100 重大行为变更： - 基于 libxposed API 100 的模块已不再受支持，基于 rovo89 Xposed API 的模块不受影响 - 某些模块查询调用栈时硬编码深度（如 AnyWebView），责任链模式下调用栈将变深，可能超出模块查询长度导致功能异常，这是模块问题，请向模块作者反馈 - 某些模块通过查询调用栈等非正规方式判断框架实现（如 XChat），可能与框架冲突导致功能异常，这是模块问题，请向模块作者反馈 Major Behavioral Changes: - Modules based on libxposed API 100 are no longer supported. Modules based on the rovo89 Xposed API are not affected. - Some modules hardcode stack depth when inspecting the call stack, such as AnyWebView. In chain-of-responsibility mode, the call stack becomes deeper and may exceed the range expected by those modules, which can cause functionality issues. This is a module issue; please report it to the module author. - Some modules attempt to detect the framework implementation through unsupported methods such as call stack inspection, such as XChat. This may conflict with the framework and cause functionality issues. This is a module issue; please report it to the module author.

libxposed API 101 has been released to the Maven Central Repository API 101 includes significant changes compared to API 82. We now only support API 82 and 101+, and other temporary solutions will be removed soon. JavaDoc: https://libxposed.github.io/api/ https://libxposed.github.io/service/

libxposed API 101 已发布到 maven 中央仓库 API 101 相比 82 有很大变更，我们只支持API 82和101+，其它临时方案即将删除。 JavaDoc： https://libxposed.github.io/api/ https://libxposed.github.io/service/

We are finalizing the draft. Here's the full breaking change logs: https://github.com/libxposed/api/pull/51#issue-3970278302

We are finalizing the draft. Here's the full breaking change logs: https://github.com/libxposed/api/pull/51#issue-3970278302

libxposed is now under RFC. We are planning the final version of the api, which is the last breaking change before publishing to MavenCentral. Please post issues if you have any suggestion or question. See https://github.com/libxposed/api/pull/51

Final version, fixes performance issue caused by code obfuscation