Information

Google Voice Typing (com.google.android.googlequicksearchbox) built-in app does not verify signature of offline speech recognition language files downloaded through the public accessible storage. An attacker can overwrite a language file and crash libgoogle_speech_jni.so app’s native lib responsible for the language files’ handling.



References:
https://research.checkpoint.com/androids-man-in-the-disk/