Do Son 
TL;DR
A researcher at ByteriaLab found a zero-click flaw in Xiaomi ShareMe, also shipped as MiDrop. An attacker within Bluetooth LE range can write arbitrary files to a victim’s phone the moment they open Receive mode. The full technical write-up and a working proof-of-concept are now public. Xiaomi’s ShareMe ships on over 1 billion devices.
Why This Matters
ShareMe is the file-sharing app preinstalled on every Xiaomi, Redmi, and POCO phone. The researcher describes it as “the AirDrop of Android.” As a result, the attack surface is enormous.
The zero-click nature makes it worse. According to the write-up, an attacker “can write arbitrary files to a victim’s phone the moment they open Receive mode.” There is “no QR scan, no accept dialog, no pairing, no encryption, no notification. The victim sees nothing.” The researcher reproduced the chain end to end on retail hardware.
Public Disclosure
Both the vulnerability details and proof-of-concept exploit code are openly available. ByteriaLab published a full technical write-up of the zero-click file drop. The matching PoC materials sit on GitHub. This open release lowers the barrier for abuse.
How the Attack Works
The core problem is trust. As the researcher puts it, “the receiver trusts whatever the sender says.” Several trust failures chain into one zero-click primitive.
First, Receive mode leaks WiFi Direct credentials. ShareMe broadcasts the SSID, password, IP, and port in cleartext over a readable, unauthenticated BLE characteristic. Anyone nearby can read it without pairing. The researcher notes “the QR code is theater; the password is already in the air.”
Next, the control protocol fails to authenticate. The mandatory key exchange accepts the literal string “test” as a public key. Plaintext messages then flow freely. In effect, knowing the WiFi password grants full protocol access.
Finally, a sender-controlled silence flag removes the victim’s consent. When set, the receiver skips the accept dialog, hides the file, and suppresses notifications. Files land in a hidden update directory that ShareMe later scans for APKs without checking signatures.
Affected Versions
The researcher reproduced the flaws across several ShareMe builds. Confirmed vulnerable versions include v3.46.08, v3.47.03, v3.47.09, and v3.48.03 on retail Redmi hardware. The BLE credential leak, the silence bypass, and the plaintext protocol were all present and exploitable. ShareMe reports over 1 billion installs, per the write-up.
Exploitation Status
A public proof-of-concept exists, released by the researcher. However, no exploitation in the wild has been confirmed at this time.
Patch and Mitigation
Users should keep ShareMe updated through official channels. Until a vendor fix lands, avoid opening Receive mode in crowded public spaces. The researcher recommends the obvious fixes, such as requiring explicit consent for every file, encrypting the BLE payload, enforcing the key exchange, and verifying APK signatures during the update scan. Disabling the “update during transfers” setting also reduces risk from the fake-update path.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
