Android has adopted Kotlin alongside Java across apps and core system components. During this shift, we observe parallel implementations in the Android Open Source Project (AOSP) where the same component is implemented in both Java and Kotlin. In principle, their functional purposes are identical. In practice, subtle semantic divergences can appear. Such divergences are not vulnerabilities by themselves, but they provide useful clues that may reveal flaws in surrounding enforcement logic. To the best of our knowledge, this paper presents the first systematic study of Java-Kotlin parallel implementations in the Android framework and examines their security implications. We design and build ParaDroid, an analysis framework that identifies parallel methods at scale and compares their behaviors. ParaDroid normalizes code into a bytecode-level intermediate representation, reconstructs class-to-source mappings, and uses large language models to reason about method semantics and identify behavioral divergences. Evaluated on AOSP Android 14-16, ParaDroid identified 329 parallel method pairs and 37 vulnerable divergences. We responsibly disclosed the exploitable issues to the Android Security Team. Three vulnerabilities and two bugs have been confirmed, and two CVE IDs have been assigned. Our results demonstrate that parallel Java-Kotlin code paths provide a practical surface for discovering security flaws in modern Android.

翻译：安卓已在应用及核心系统组件中采用Kotlin与Java并行开发。在此转变过程中，我们观察到安卓开源项目（AOSP）中存在并行实现现象，即同一组件同时采用Java和Kotlin两种语言编写。原则上，这些实现的功能目标完全一致，但实践中可能出现细微的语义分歧。此类分歧本身并非安全漏洞，却可能为发现周边安全逻辑缺陷提供关键线索。据我们所知，本文首次系统研究了安卓框架中的Java-Kotlin并行实现及其安全影响。我们设计并构建了分析框架ParaDroid，该框架可大规模识别并行方法并比较其行为差异。ParaDroid将代码标准化为字节码级中间表示，重构类到源文件的映射关系，并利用大语言模型推理方法语义以识别行为分歧。在AOSP安卓14-16版本上的评估中，ParaDroid识别出329对并行方法及37个存在漏洞的语义分歧。我们已向安卓安全团队负责任地披露了可被利用的安全问题，其中3个漏洞和2个程序缺陷已获确认，并分配了2个CVE编号。研究结果表明，并行Java-Kotlin代码路径为发现现代安卓系统安全缺陷提供了切实可行的分析切入点。