01.09.2026
3 min
130
The latest flagship smartphones from Samsung, Xiaomi, Oppo, and OnePlus, all running up-to-date security patches, were found vulnerable to an attack through a regular unprivileged app. The problem is not Android itself: critical flaws were discovered in software added by manufacturers that has deep access to the device.
Lukas Maar, a security researcher at Calif, discovered a serious weakness in Android devices. The vulnerable component turned out to be software added by smartphone manufacturers, which under certain conditions can allow an attacker to gain root access on devices from major brands.
The researcher demonstrated how a regular unprivileged app with no declared permissions could gain full control over an Android device.
The attack strategy, dubbed “OEMpocalypse Now,” led to the creation of three exploit chains. They target Samsung flagships ranging at least from the Galaxy S23 series to the Galaxy S26 series, as well as newer Galaxy Z models, most mid-range and flagship Xiaomi smartphones, and recent flagship devices from Oppo, OnePlus, and Realme.
The exploits are not tied to a specific Android version, chipset, kernel version, or even a particular device model. The reason is that many smartphones from the same manufacturer use the same additional software layers on top of Android, such as One UI, HyperOS, or ColorOS, along with manufacturer-specific kernel drivers.
“The core idea is to only target code written by Original Equipment Manufacturers (OEMs) such as Samsung and Xiaomi,” Maar explained in the first part of the research. “None of the drivers gave the impression that they had been written with a hostile caller in mind.”
Root access gives an attacker almost complete control over a device and the data stored on it. It makes it possible to bypass Android’s standard permission model and modify system-level settings that are normally inaccessible to the user. In certain scenarios, this could potentially even result in hardware damage.
The researcher did not release the proof-of-concept code and shared only several video demonstrations showing successful exploitation of flagship smartphones. Maar plans to continue the research series and provide a more detailed breakdown of each OEM exploit chain for the individual manufacturers.
Third-party Android apps run in an isolated environment known as untrusted_app. Under normal circumstances, they cannot interact directly with kernel drivers and certainly should not be able to gain root access.
Maar describes an untrusted_app-to-root exploit that, according to him, achieves nearly 100% reliability regardless of the active security mechanisms or Android configuration. It can also be adapted with minimal changes across different kernel versions, OEMs, chipsets, and specific device models.
The first stage is escaping the sandbox. Android already provides numerous mechanisms that allow apps and system components to communicate with one another through what is known as inter-process communication (IPC). OEM software further expands this attack surface by adding its own apps, services, and background processes, each of which may expose additional IPC interfaces. Some of these components can also interact directly with kernel drivers.
A single logic flaw in one of these OEM IPC handlers, such as a missing caller check, an incorrectly exported component, or an unvalidated file path, can be enough to cross a privilege boundary, Maar explains.
The researcher exploited a flaw located entirely within the OEM’s user-space software logic to move from a regular untrusted_app into an OEM-owned process with significantly broader system privileges.
In the second stage, the researcher exploited a use-after-free vulnerability in an OEM-specific kernel driver. The driver continued to hold a reference to a particular memory page even after the kernel had freed it for reuse. This made it possible to use the stale reference to access and modify kernel data.
“I then instantiated the strategy three times, once per major Android OEM, finding multiple vulnerabilities along the way,” the researcher said.
Each of the test apps required no declared permissions. They were tested on the Samsung Galaxy S26 Ultra, Galaxy S26, and Galaxy S23, Xiaomi 17, Oppo Find X9 Ultra, and OnePlus Ace 6 Ultra.
Google Pixel devices, which run Android without the vulnerable OEM components targeted by this attack, are not susceptible to the method described. Gaining root access on a Pixel would require a more general vulnerability, such as one in the Linux kernel itself.
The research also warns that use-after-free vulnerabilities are difficult to mitigate once they make their way into kernel code. Addressing such issues requires auditing drivers that map kernel-owned memory pages into user or device address spaces and ensuring that every mapping is removed before the corresponding memory page is freed.
