Security risk assessment of android automotive OS software supply chain using firmware reverse engineering

As Android Automotive OS (AAOS) becomes the in-vehicle platform of choice for infotainment and domain-controller functions in modern passenger cars, its software supply chain has emerged as a critical security frontier. AAOS spans both infotainment and vehicle-control domains within the automotive electronics architecture by supporting media streaming, over-the-air updates, navigation, and sensor fusion. Its open-source foundations and reliance on third-party libraries introduce risks, from outdated components to malicious modules, that can undermine vehicle functionality and passenger safety. In recognition of these threats, ISO/SAE 21434 and UNECE WP.29 R155 mandate structured security assessments for vehicular systems to prevent software-chain vulnerabilities from compromising safety. In this study, we apply a shift-right security analysis via firmware reverse engineering to AAOS images from four leading OEMs. We unpack each firmware image, extract software bills of materials (SBOMs), map Common Vulnerabilities and Exposures (CVE) to components, and characterize system-level attack surfaces across infotainment and control subsystems. Proof-of-concept exploits were developed for high-risk vulnerabilities. One critical CVE was successfully triggered, while others were mitigated by missing dependencies or built-in protections. Our work delivers a reproducible firmware-analysis workflow for automotive supply-chain risk assessment, a comparative survey of third-party and proprietary component management, and the evidence of inconsistent security postures in AAOS-based vehicular electronics. These vulnerabilities underscore the need for harmonized SBOM practices and targeted hardening in next-generation in-vehicle systems.