#NullconBerlin2025 | My Other ClassLoader is Your ClassLoader Reloaded: Reviving Parcelable Objects

This talk by Dimitrios Valsamaras delves into the intricacies of Java ClassLoaders and their role in the Android ecosystem, particularly regarding Parcelable objects. The speaker explains how the dynamic loading of classes can be exploited in the context of data transfer, highlighting the security vulnerabilities that arise from trusting serialized objects from untrusted sources. Valsamaras introduces a technique for intercepting and modifying Parcelable objects, demonstrating how attackers can manipulate serialized data with ease. The discussion emphasizes the critical need for improved security practices in Android development to safeguard against these potential exploits.