I am wondering if it could be possible to sort of "bypass" the certificate pinning protection of Android or iOS using for example the POODLE SSL vulnerability. According to this blog entry it is possible to extract the SSL encryption key using Padding Oracle attacks.
When I got the key I can decrypt the SSL stream without violating the SSL pinning. I could send my own packets to the server because I can encrypt it with the correct encryption key, right?
The aim would be to change data on the fly in a pinned TLS connection where I got the key for without removing the pinning protection. Is this possible (theoretically)?