This poc gets a system-uid reverse shell.
If you want to change the remote IP and port for the reverse shell, please modify solib/jni/libmstring/mstring.c ip variable.
Detailed writeup can be found at https://blog.flanker017.me/text-to-speech-speaks-pwned/
Tested on Galaxy Series.