OEMpocalypse Now: A Generic Exploitation Strategy from Android untrusted app to root
Part 1 of a series that takes an unprivileged Android app to root on Samsung, Xiaomi, and Oppo/OnePlus/Realme devices, with a single strategy.
On Android, every third-party app runs in a sandboxed context called untrusted_app. Security researcher Lukas Maar describes a strategy targeting OEM-specific kernel drivers rather than generic Linux or chipset code, using page Use-After-Free (UAF) bugs in OEM kernel drivers combined with OEM-specific sandbox escapes where SELinux policy requires them.
TL;DR
- Strategy: Exploit a page UAF in an OEM-specific kernel driver. Where the OEM’s SELinux policy gates that driver behind a privileged domain, reach it via an OEM-specific sandbox escape first. Every bug involved lives in OEM code rather than in generic Linux or chipset drivers.
- Why: A page UAF reached from the right context can provide a stable physical page-level primitive that is largely independent of kernel version, slab hardening, KASLR, CFI, and the specific phone model.
- Coverage: Three instantiations of the same strategy cover all Samsung flagship devices (at least the Galaxy S23 through S26 series and the recent Z series), most Xiaomi mid-range to flagship devices, and recent Oppo, OnePlus, and Realme flagships.
The OEMpocalypse Strategy
By OEM-specific code Maar means the kernel drivers and userspace services that the OEM (Samsung, Xiaomi, or Oppo) ships as part of its own software stack on top of Android. The same component tends to be present across that OEM’s lineup regardless of chipset (Snapdragon, Exynos, Dimensity, etc.).
Stage 1: Escaping the Sandbox
Stage 1 uses logic flaws in OEM IPC endpoints to move from untrusted_app into an OEM-owned process whose SELinux domain can open the target kernel driver. Bugs live entirely in OEM userspace logic and do not depend on chipset or kernel version.
Stage 2: The Page UAF
Stage 2 is a page UAF in an OEM kernel driver. A page UAF gives a reference that keeps pointing at a physical page after the kernel has freed and reallocated it. The primitive operates at the page level, reducing dependence on slab hardening, KASLR leaks, and CFI.
The Three Chains at a Glance
Each chain is packaged as an ordinary Android app with no declared permissions. Demo videos show devices with locked bootloaders (Verified boot: green, Bootloader lock: 1, VBMeta state: locked) being rooted.
| OEM | Device | Chipset | Android | Kernel | Firmware |
|---|---|---|---|---|---|
| Samsung | Galaxy S26 Ultra | Snapdragon 8 Elite Gen 5 | 16 | 6.12.30 | Jul 2026 |
| Samsung | Galaxy S26 | Exynos 2600 | 16 | 6.12.38 | Jul 2026 |
| Samsung | Galaxy S23 | Snapdragon 8 Gen 2 | 14 | 5.15.148 | Mar 2025 |
| Xiaomi | Xiaomi 17 | Snapdragon 8 Elite Gen 5 | 16 | 6.12.23 | Jul 2026 |
| Oppo family | Oppo Find X9 Ultra | Snapdragon 8 Elite Gen 5 | 16 | 6.12.58 | Jul 2026 |
| Oppo family | OnePlus Ace 6 Ultra | MediaTek Dimensity 9500 | 16 | 6.12.58 | Jul 2026 |
Conclusion
The strategy gives up cross-OEM coverage (a Samsung chain does nothing on Xiaomi) but within each OEM provides reliable, portable exploits across flagship lineups. Defensive takeaway: page UAF bugs in drivers that map kernel-owned pages into userspace are hard to mitigate once present; SELinux gating is only as strong as the OEM’s userspace IPC surface into privileged domains.
The series continues with per-OEM technical posts for Samsung, Xiaomi, and Oppo/OnePlus/Realme.