GoKawiilPart 1 of a series that takes an unprivileged Android app to root on Samsung, Xiaomi, and Oppo/OnePlus/Realme devices, with a single strategy.
On Android, every third-party app runs in a sandboxed context called untrusted_app . If you ask five offensive security researchers how to go from this context to root , you will most likely get five different strategies, and each has its own trade-offs. Here, I describe the one I took and why, measured against three properties I use as a yardstick throughout:
Reliability, i.e., succeed at near-100 percent regardless of which defenses or customizations are enabled. Portability, i.e., run with minimal per-kernel-version, per-OEM, per-chipset, or per-device adjustment. Universality, i.e., cover as many devices as possible.
The core idea is to only target code written by Original Equipment Manufacturers (OEMs) such as Samsung and Xiaomi. Specifically, I target a page Use-After-Free (UAF) in an OEM-specific kernel driver, using an OEM-specific sandbox escape to reach that driver where the OEM's SELinux policy requires one. In brief, a page UAF is a bug that leaves a live reference to a physical memory page after the kernel has freed it, and a sandbox escape is any bug that lets code cross from a lower-privilege process into a higher-privilege one. I then instantiated the strategy three times, once per major Android OEM, finding multiple vulnerabilities along the way and yielding chains that cover all Samsung flagship devices (at least the Galaxy S23 through S26 series and the recent Z series), a large share of Xiaomi mid-range to flagship devices, and recent Oppo, OnePlus, and Realme flagship devices.
Figure 1: The Samsung chain end to end on a bootloader-locked Galaxy S26 Ultra. Recordings for the other four tested devices are in The Three Chains at a Glance.
This first post explains the reasoning behind the strategy and compares it with two alternatives. The subsequent posts will provide technical details of these chains.
TL;DR
Strategy: Exploit a page UAF in an OEM-specific kernel driver. Where the OEM's SELinux policy gates that driver behind a privileged domain, reach it via an OEM-specific sandbox escape first. Every bug involved lives in OEM code rather than in generic Linux or chipset drivers.
Exploit a page UAF in an OEM-specific kernel driver. Where the OEM's SELinux policy gates that driver behind a privileged domain, reach it via an OEM-specific sandbox escape first. Every bug involved lives in OEM code rather than in generic Linux or chipset drivers. Why: A page UAF reached from the right context can provide a stable physical page-level primitive that is largely independent of kernel version, slab hardening, KASLR, CFI, and the specific phone model, which is exactly what a weaponized chain needs.
A page UAF reached from the right context can provide a stable physical page-level primitive that is largely independent of kernel version, slab hardening, KASLR, CFI, and the specific phone model, which is exactly what a weaponized chain needs. Coverage: Three instantiations of the same strategy cover all Samsung flagship devices (at least the Galaxy S23 through S26 series and the recent Z series), most Xiaomi mid-range to flagship devices, and recent Oppo, OnePlus, and Realme flagships.
... continue reading