Remote Code Execution in Android bta_hf_client_cb_init Use-After-Free

This repository is a proof-of-concept (PoC) exploit for CVE-2025-48593, a vulnerability in the Android Bluetooth stack affecting devices that can act as Bluetooth headsets/speakers (e.g., smartwatches, smart glasses, cars). The PoC consists of a Python script ('blueshrimp.py') that uses the Bumble Bluetooth stack to emulate a Bluetooth Audio Gateway and interact with a target device over Bluetooth. The script manipulates SDP (Service Discovery Protocol) and RFCOMM channels to attempt to trigger the vulnerable code path, resulting in a crash (null dereference or invalid memory write) in the target's Bluetooth stack, as evidenced by included crash logs. The exploit does not achieve code execution or privilege escalation; it only demonstrates a denial-of-service condition. The repository also includes a Frida script ('dumpbt.js') for dynamic analysis and debugging of the Bluetooth stack on an Android emulator, and a configuration file ('device.json') for the Bumble stack. The README provides detailed context, limitations, and crash results, emphasizing that the exploit is not effective on real devices and only works on specially configured emulators. The overall structure is typical for a research PoC, with clear separation between exploit code, analysis tools, and documentation.