FlagThis

Abstract

In recent versions of AOSP, we observe a recurring phenomenon that we term parallel implementations: two codepaths, one in Java and one in Kotlin, that are designed to serve an identical functional purpose. Specifically, they aim to achieve the same operational outcome, even though their internal implementation logic and coding patterns may differ. These pairs may reside in the same or different packages, use similar class names, or be activated at runtime through version checks. Parallel implementations often appear during staged migrations or refactoring. Conceptually, they are meant to be interchangeable. In practice, however, subtle semantic differences can emerge. While such differences are not always vulnerabilities in isolation, they can provide critical clues that reveal flaws in the surrounding enforcement logic. Our motivating case (Section 3.1) in the Android permission subsystem demonstrates that the divergence between the Java and Kotlin paths exposes an inconsistency in enforcement logic, which could be exploited to obtain unauthorized sensitive information. Android has adopted Kotlin alongside Java across apps and core system components. During this shift, we observe parallel implementations in the Android Open Source Project (AOSP) where the same component is implemented in both Java and Kotlin. In principle, their functional purposes are identical. In practice, subtle semantic divergences can appear. Such divergences are not vulnerabilities by themselves, but they provide useful clues that may reveal flaws in surrounding enforcement logic. To the best of our knowledge, this paper presents the first systematic study of Java-Kotlin parallel implementations in the Android framework and examines their security implications. We design and build ParaDroid, an analysis framework that identifies parallel methods at scale and compares their behaviors. ParaDroid normalizes code into a bytecode-level intermediate representation, reconstructs class-to-source mappings, and uses large language models to reason about method semantics and identify behavioral divergences. Evaluated on AOSP Android 14-16, ParaDroid identified 329 parallel method pairs and 37 vulnerable divergences. We responsibly disclosed the exploitable issues to the Android Security Team. Three vulnerabilities and two bugs have been confirmed, and two CVE IDs have been assigned. Our results demonstrate that parallel Java-Kotlin code paths provide a practical surface for discovering security flaws in modern Android.