A security researcher has demonstrated how an Android app with no permissions can gain root access on flagship phones from several major manufacturers. The attack bypasses the operating system’s sandbox and gives the app almost complete control of the device.
The vulnerabilities affect software and kernel drivers added by phone manufacturers. Therefore, the researcher says the underlying problem does not originate in stock Android.
Unprivileged App Takes Control of Flagships
Lukas Maar, a security researcher at Calif, developed three exploit chains targeting devices from Samsung, Xiaomi, Oppo, OnePlus and Realme.
He named the research project “OEMpocalypse Now.” The attacks focus specifically on software developed by original equipment manufacturers.
Maar demonstrated the technique on several flagship smartphones running the latest available security updates. The tested devices included the Samsung Galaxy S26 Ultra, Galaxy S26 and Galaxy S23.
He also tested the attack on the Xiaomi 17, Oppo Find X9 Ultra and OnePlus Ace 6 Ultra. Every malicious test application had no declared permissions.
Nevertheless, the apps could escape Android’s restrictions and open a root shell. Root access provides extensive control over the operating system and the information stored on the device.
The affected product range may extend beyond the tested phones. According to the researcher, the Samsung exploit chains cover models from at least the Galaxy S23 through the S26 series and recent Galaxy Z devices.
The findings also apply to many Xiaomi mid-range and flagship phones. Furthermore, recent Oppo, OnePlus and Realme flagships use related vulnerable components.
Manufacturer Software Creates Weak Point
The Android OEM flaws do not depend on one Android release, chipset, kernel version or device model.
Instead, the attack targets additional software layers that manufacturers install on top of Android. These platforms include interfaces such as One UI, HyperOS and ColorOS.
Manufacturers also add their own system services, background processes and kernel drivers. These components often hold powerful permissions because they manage hardware and proprietary device features.
However, this privileged access creates additional attack paths. A weakness in one manufacturer component may allow an ordinary app to cross security boundaries.
Maar said the vulnerable drivers did not appear designed to handle calls from a hostile application. As a result, they lacked protections needed against malicious input.
Stock Android devices do not include the same manufacturer-specific software. For example, the researcher said Pixel phones would not be vulnerable to these particular exploit chains.
An attacker would instead need a broader Android or Linux kernel vulnerability to gain root access on those devices.
Attack Begins With Sandbox Escape
Android normally runs third-party applications inside a restricted sandbox known as untrusted_app. This environment prevents ordinary software from accessing sensitive system resources.
Such apps should not communicate directly with kernel drivers. They should also remain far away from root privileges.
However, Android provides inter-process communication endpoints that allow applications and services to exchange information.
Phone manufacturers expand this attack surface when they add proprietary apps, services and background daemons. Each new component may introduce more communication endpoints.
Some manufacturer services can also open and communicate with privileged kernel drivers. Therefore, a vulnerable service can become a bridge between an untrusted app and the kernel.
Maar said a single logic error may allow an attacker to cross this boundary. Examples include a missing caller check, an incorrectly exported component or an unvalidated file path.
For the first attack stage, he exploited a bug within manufacturer-developed userspace software. This flaw moved the malicious app into a process controlled by the phone manufacturer.
Kernel Driver Flaw Delivers Root Access
After escaping the sandbox, the attack targeted a use-after-free vulnerability in an OEM-specific kernel driver.
A use-after-free flaw occurs when software continues referencing memory after the system has released it. The operating system may then assign the same memory to another process or purpose.
In this case, the driver retained a reference to a memory page after the kernel released it. The stale reference allowed the researcher to access and modify kernel data.
Combining the userspace logic flaw with the kernel driver bug produced root access. Maar repeated the overall strategy across three major Android manufacturer ecosystems.
He described the technique as highly reliable and broadly portable. It reportedly requires only limited changes between kernel versions, manufacturers, chipsets and phone models.
The researcher has not published proof-of-concept code. Instead, he released several videos showing the attacks against flagship devices.
He plans to publish additional research explaining each manufacturer-specific exploit chain in more detail.
Root Access Can Bypass Android Protections
Root access allows a malicious app to bypass Android’s standard permission system. It can potentially read protected information and manipulate settings that users cannot normally access.
An attacker may also interfere with security controls, monitor activity or maintain hidden access to the device.
In extreme cases, unauthorised changes to low-level system or hardware settings could damage the phone.
These kernel vulnerabilities are difficult to mitigate once an attacker reaches the vulnerable driver. Therefore, manufacturers must audit drivers that map kernel-owned memory into userspace or device address spaces.
Developers must ensure that every mapping ends before the kernel releases the associated memory page. Otherwise, a stale reference may continue exposing sensitive kernel data.
0 responses to “Android OEM Flaws Give Unprivileged Apps Root Access”