Research claims OEM-specific exploit chain roots Samsung, Xiaomi, and Oppo phones from unprivileged apps

The research presents a claimed exploit path that targets OEM-specific kernel drivers and userspace components rather than shared Android or chipset code. This approach is designed to leverage code shared across an OEM’s product line, potentially enabling a single exploit chain to affect multiple device models. The strategy relies on two stages: first, escaping the untrusted_app SELinux domain via a flaw in OEM userspace IPC, and second, exploiting a page use-after-free in an OEM kernel driver to achieve root access. The claimed advantage is portability across an OEM’s devices, but the trade-off is the need to develop separate chains for each manufacturer.

A key technical detail is the use of a page-level use-after-free, which the research argues is less dependent on allocator behavior than slab-object corruptions. This primitive is intended to provide stability across different device models, reducing the need for target-specific tuning. However, the exploit’s effectiveness depends on the OEM’s SELinux policies and the specific drivers exposed to unprivileged apps. For example, on Samsung’s Galaxy S26 Ultra, the research cites Qualcomm’s KGSL interface and DRM render nodes as potential entry points, but these vary by chipset and device configuration.

The research explicitly avoids targeting shared Linux or Android Common Kernel code, which would require heap grooming and cross-cache techniques. Instead, it focuses on OEM-specific components, which may persist across an OEM’s devices regardless of chipset. This choice expands the potential attack surface but introduces complexity, as each OEM’s customizations require a tailored exploit chain. The lack of disclosed CVEs, patch status, or affected firmware builds means engineers cannot yet assess the scope of the issue or prioritize remediation.

For engineers, the claimed exploit path underscores the risks of OEM customizations, particularly where they intersect with kernel-level access. The research suggests that even bootloader-locked devices may be vulnerable if OEM drivers or userspace components contain flaws. However, the absence of technical details for the Xiaomi and Oppo-family chains leaves open questions about the exploit’s applicability beyond Samsung. Until further disclosures or vendor advisories are published, the practical impact remains speculative, though the approach highlights a new vector for privilege escalation.