21.07.2026
4 min
289
Cybersecurity researchers discovered five serious vulnerabilities in the webOS platform that could allow attackers to bypass security protections on LG TVs and gain the highest level of system privileges. To carry out the attack, an attacker only needs to be connected to the same network as the device, with no need to enter a PIN, approve a connection, or perform any actions on the TV itself. LG has already released security patches.
The dangerous flaws were disclosed by SSD Secure Disclosure, a platform specializing in vulnerability disclosure. Researchers demonstrated an attack chain involving multiple security flaws that allows attackers to bypass authentication and execute arbitrary commands with root privileges.
Root access provides the highest level of privileges in an operating system. With this access, an attacker could potentially modify system files, execute their own code, and interfere with the device’s operation without the owner’s permission.
The attack was tested on two TV models: LG 32LQ636BPSA and LG 27TQ600SW. Both devices were running webOS 7.5.7-25 with firmware version 04.54.40. The exact number of models potentially affected by these vulnerabilities remains unknown.
The most concerning aspect is that exploiting these flaws requires no user interaction. An attacker connected to the same network as the TV can carry out the attack without requesting device pairing, entering a PIN, or obtaining confirmation on the screen.
To gain initial access, the researchers exploited a built-in webOS application called sync-demo. It contained a digitally signed manifest, a special file that defines an application’s permissions and privileges.
Normally, connecting a new client to a TV requires a pairing process in which the owner approves access. However, the researchers discovered that the sync-demo manifest contained the STB_INTERNAL_CONNECTION permission, which allowed this step to be skipped.
By reusing the signed manifest already present in the system, they were able to submit it to the TV again. The system verified the digital signature, recognized the document as trusted, and created a new client profile with the corresponding privileges.
The researchers explained in their technical report:
“After verification, the signed permissions are copied into the new client profile.”
As a result, the TV issued a new client-key without requiring connection approval. This allowed attackers to bypass the standard security mechanism designed to prevent unauthorized control of the device.
After gaining access to the TV, the researchers exploited another trusted webOS application called cmp-client. This application had extensive system privileges and could interact with internal operating system services.
The problem was that cmp-client accepted a web address through the interactiveUrl parameter without properly validating it. The application could open an external website without verifying that the address belonged to a trusted source.
As the researchers noted:
“There is no URL scheme validation, host allowlist, or origin restriction. The application then navigates to attacker-controlled content.”
This made it possible to force a trusted system application to load a webpage prepared by an attacker. The loaded website retained access to a special interface called PalmServiceBridge, which is used to communicate with internal webOS services.
Through this mechanism, external code could access the TV’s system functions with the privileges of cmp-client. In particular, it could invoke Luna Services methods that were unavailable to an ordinary remote client through a WebSocket connection.
The second vulnerability therefore allowed attackers to expand their initial access and reach internal components of the operating system.
The final stage of the attack involved a flaw in the webOS logging service. Researchers discovered that the pmlogd component, which runs with the highest system privileges, did not adequately validate file paths supplied during command execution.
Specifically, the collectAllLog method used the targetDir and targetFile parameters to construct system shell commands. However, the supplied values were not properly sanitized to remove special characters.
As a result, an attacker could provide a specially crafted path that the system interpreted not only as a directory name but also as an additional command.
Because the PmLogDaemon service ran with root privileges, the injected command was also executed with the highest level of access. By combining three separate flaws into a single attack chain, the researchers achieved full control over the vulnerable device.
In practice, the attack unfolded in several stages: first, the TV issued an access key without the owner’s approval; next, a trusted application loaded a malicious webpage; and finally, the logging service vulnerability allowed a system command to be executed as root.
In September 2026, LG released a security update addressing a total of five high-severity vulnerabilities in webOS.
Meanwhile, researchers published a working Proof of Concept (PoC) demonstrating how the discovered flaws could be exploited. This means the technical details of the attack are now publicly available, rather than being limited to developers and cybersecurity professionals.
The SSD Secure Disclosure report, published on October 12, 2026, describes the complete exploitation chain. It also notes that the independent researcher who demonstrated the attack placed third in the LG webOS category at the TyphoonPWN 2026 competition.
The researchers proposed several measures to address the underlying causes of the vulnerabilities. These included removing the embedded signed manifest from sync-demo, preventing the use of test signing certificates in production firmware, and strengthening permission checks during device pairing.
For cmp-client, the researchers recommended validating web addresses before opening them and preventing external webpages from accessing PalmServiceBridge. They also emphasized the need to handle file paths securely in the logging service and avoid constructing system commands using unvalidated text parameters.
The main recommendation for LG TV owners using webOS is to install the latest available firmware update. Users can check for updates through the TV’s system settings, although the exact navigation path depends on the model and operating system version.
If a security patch is not yet available for a particular device, researchers recommend disconnecting the TV from the network until the update can be installed. Network connectivity is a necessary condition for the demonstrated attack scenario.
Importantly, these vulnerabilities do not mean that any LG TV can be hacked over the internet. In the demonstrated attack, the attacker must have access to the same network as the device. However, this does not eliminate the risk for TVs connected to shared or poorly secured networks.
LG has already fixed the discovered flaws, but the publication of a working exploit makes timely updates especially important. With the complete list of affected models still unknown, webOS TV owners should check for new firmware and install available updates without delay.
