GoKawiilSecurity researcher finds single exploit strategy rooting Samsung, Xiaomi, Oppo devices
A security researcher has published a series detailing how an unprivileged Android app can escalate to root access on major OEM devices using one repeatable strategy. The method targets manufacturer-specific kernel driver bugs—specifically page Use-After-Free flaws—reached via OEM-specific sandbox escapes, and was demonstrated on Samsung Galaxy S23 through S26 devices, many Xiaomi mid-range to flagship phones, and recent Oppo, OnePlus, and Realme flagships.
GoKawiil's interpretation of the reporting above, not reported fact.
This approach is notable because it doesn't rely on generic Android kernel bugs but instead systematically exploits the custom code OEMs add to differentiate their devices, code that often receives less security scrutiny than upstream Android or the Linux kernel. Because the technique was proven reliable, portable, and broadly applicable across three separate manufacturers, it suggests a structural weakness in how OEMs harden their custom drivers, potentially affecting millions of devices until patched.
- A single exploitation strategy achieved root access across Samsung, Xiaomi, and Oppo/OnePlus/Realme devices.
- The technique exploits OEM-specific kernel driver bugs (Use-After-Free) reached through custom sandbox escapes.
- Affected devices include Samsung's S23-S26 and Z series, many Xiaomi models, and recent Oppo/OnePlus/Realme flagships.
Source: calif.io, 2026-09-14
Published there as: “OEMpocalypse: Unprivileged Android app to root on Samsung, Xiaomi, others”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.