GoKawiilRobert Triggs / Android Authority
TL;DR A vulnerability in Qualcomm’s Android Bootloader implementation allows unsigned code to run via the “efisp” partition on Android 16 devices.
This is paired with a “fastboot” command oversight to bypass SELinux and gain the permissions needed to unlock the bootloader.
This is further chained with vulnerability in Xiaomi’s Hyper OS to allow bootloader unlocking on the Xiaomi 17 series and more. Other Snapdragon 8 Elite Gen 5 phones could also be affected, though the chain of vulnerabilities could differ.
The Snapdragon 8 Elite Gen 5 is the newest flagship SoC from Qualcomm, and it’s undoubtedly one of the best chips that you can find on top Android flagships. We’re seeing widespread adoption of the SoC across phones like the Xiaomi 17 series, the OnePlus 15, and even the recently launched Galaxy S26 Ultra. This week, a new exploit came to light that appears to affect Qualcomm SoCs, primarily the latest Snapdragon 8 Elite Gen 5, allowing users to unlock the bootloader on phones that were previously notoriously difficult to unlock.
Don’t want to miss the best from Android Authority? Set us as a favorite source in Google Discover to never miss our latest exclusive reports, expert analysis, and much more.
to never miss our latest exclusive reports, expert analysis, and much more. You can also set us as a preferred source in Google Search by clicking the button below.
What is the Qualcomm GBL Exploit? A new exploit, dubbed “Qualcomm GBL Exploit,” has been floating around the internet over the past few days. While the identity of the discoverer is contentious, this exploit appears to target an oversight in how GBL (Generic Bootloader Library) is loaded on modern Android smartphones running on Qualcomm SoCs.
In a nutshell, Qualcomm’s vendor-specific Android Bootloader (ABL) is attempting to load the GBL from the “efisp” partition on phones shipping with Android 16. But in doing so, the Qualcomm ABL is merely checking for a UEFI app in that partition, rather than verifying its authenticity as the GBL. This opens the possibility of loading unsigned code onto the efisp partition, which is executed without a check. This forms the core of the Qualcomm GBL exploit.
GBL exploit gets chained with other vulnerabilities However, writing to the efisp partition isn’t possible by default because SELinux is set to Enforcing, which blocks disallowed actions. To allow the efisp partition to be written to, SELinux needs to be set to Permissive mode, which can be done if you have root access. However, Permissive SELinux is itself required to unlock the bootloader via the GBL exploit and obtain root privileges, leaving you back at square one.
... continue reading