MSc thesis supervision: A Systematic Study of Real-World Exploit Complexity in Android Security Bulletins

Supervised an MSc thesis that reproduced CVEs from the Android Security Bulletin on physical devices to test how well CVSS scores reflect real-world exploit complexity. It found frequent discrepancies, mostly towards lower actual severity.

CVSS scores drive patch prioritisation, yet earlier research shows they are inconsistent across evaluators and often ignore context. This thesis tested how that plays out on physical Android devices.

The student built a tool that collected every CVE from the Android Security Bulletin and prioritised those that were likely exploitable and practical to reproduce. The selected vulnerabilities were then reproduced on real devices. A high share showed discrepancies with their official scores in both exploitability and impact. The causes included privilege granularity, Android's permission architecture and ambiguous metric interpretation. Most justified adjustments lowered the severity.

The broader point lines up with my own research: severity scores, like test suites, can look authoritative while missing the context that decides real-world risk.

References