Definition
A vulnerability that lets code cross from a lower-privilege process or SELinux domain into a higher-privilege one — e.g., from untrusted_app to a domain that can access a gated OEM kernel driver.
Key Points
- 2026-09: First stage in oempocalypse chains when OEM SELinux policy restricts target page-uaf driver to privileged domain (2026-09-14-oempocalypse-android-root)
- Implemented via logic flaws in OEM IPC endpoints rather than generic Android bugs
- Combined with page UAF in OEM kernel drivers for full root on locked-bootloader devices