Android security nightmare: unprivileged app take over flagship phones
Samsung Galaxy S26 Ultra, Xiaomi 17, Oppo Find X9 Ultra, and OnePlus Ace 6 Ultra are among the smartphones vulnerable to the exploit.
- A researcher demonstratd an unprivileged app gaining root access on Samsung, Xiaomi, Oppo, OnePlus, and Realme flagships.
- The flaws sit in manufacturer-added software and drivers, not stock Android itself.
- The attack first escapes the app sandbox, then abuses a memory flaw in an OEM kernel driver.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
The latest flagships from Samsung, Xiaomi, Oppo, and OnePlus – all running the latest security updates – fell to an unprivileged app. And it’s not Android’s fault – the software added by phone manufacturers is critically vulnerable and has deep access to the system.
Lukas Maar, a security researcher at Calif, has unveiled an uncomfortable weak point in Android devices – OEM software is critically vulnerable, allowing attackers to pop a root shell on major smartphone brands.
The researcher demonstrated an unprivileged app with no permissions taking full control of Android devices.
The same hacking strategy, dubbed “OEMpocalypse Now,” produced three exploit chains targeting Samsung flagships from at least the Galaxy S23 through the S26 series and the recent Z series, most Xiaomi mid-range to flagship devices, and recent Oppo, OnePlus, and Realme flagships.
The exploits weren’t tied to a specific Android version, chipset, kernel version, or even device model. Many smartphones run the same flawed additional software layer on top, like One UI, HyperOS, or ColorOS, with OEM-specific kernel drivers.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
“The core idea is to only target code written by Original Equipment Manufacturers (OEMs) such as Samsung and Xiaomi,” Maar said in the first part of the research.
“None of the drivers gave the impression of having been written with an adversarial caller in mind.”
Root access grants attackers near-complete control over the device and its data, bypassing Android’s permission model and even allowing them to manipulate user-inaccessible system-level settings, potentially causing hardware damage.
The researcher didn’t reveal the proof-of-concept code and only shared several video clips as evidence of hacking flagship smartphones. Maar plans to continue the series with a more detailed look into each per-OEM chain.
How do the exploits work?
Third-party Android apps run in a sandboxed context called untrusted_app – they typically can’t talk to kernel drivers directly and should never be anywhere near root permissions.
Maar describes an untrusted_app-to-root exploit that reportedly achieves near-100% reliability regardless of Android defenses or customizations, is portable with minimal per-kernel-version, per-OEM, per-chipset, or per-device adjustments, and universally covers many devices.
The exploit is implemented in two major stages.
The first one is sandbox escape. Android already provides many ways for apps to interact with each other, via so-called Inter-Process Communication (IPC) endpoints. OEM software expands this attack surface by adding its own apps, services, and daemons, each with an additional set of such endpoints. And OEM components can open the kernel driver.
A single logic flaw in one of these OEM IPC handlers, e.g., a missing caller check, an exported component that should not be, or an unvalidated file path, is enough to cross a privilege boundary,Maar explains.
The researcher leveraged a bug that lives entirely in OEM userspace logic to move from an untrusted app into an OEM-owned process.
In the second stage, the researcher targeted a use-after-free vulnerability in an OEM-specific kernel driver. The driver retained a reference to a specific chunk of memory (a page) after the kernel had released it for reuse, allowing the researcher to use that stale reference to access and modify kernel data.
“I then instantiated the strategy three times, once per major Android OEM, finding multiple vulnerabilities along the way,” the researcher said.
Each app with no declared permissions had been tested on Samsung Galaxy S26 Ultra, S26, and Galaxy S23, Xiaomi 17, Oppo Find X9 Ultra, and OnePlus Ace 6 Ultra.
Pixel, running stock Android, wouldn’t be vulnerable to this kind of vulnerability – a more generic Linux kernel bug would be required to root it.
The report warns that this class of use-after-free bugs is hard to mitigate once it reaches kernel code. Addressing it requires auditing drivers that map kernel-owned pages into userspace or device address spaces and ensuring that every mapping is torn down before the page is released.