ApkFuzz: Search-Based Fuzzing for Android APK Vulnerability

While most work focuses on executable code, AndroidManifest.xml, which is the primary entry point for application metadata and permission logic, is often overlooked, making it a high-trust, low-scrutiny attack surface. We present ApkFuzz, an AFL-based fuzzer with bit-level mutations targeting the encoded region of AndroidManifest.xml in the APK file. We have identified 9 issues that cause crashes and enable denial-of- service (DoS) attacks in core tools, including Google’s apksigner and the widely used research tool DroidBot.