privilege-escalation-techniqueendpoint-software-vulnerabilityprivilege-escalation-method

OEMPocalypse Exploit Chains Achieve Kernel Compromise on Major Android OEMs

Attack Tradecraft · 3 sources · Updated 2mo ago · First seen Aug 31, 2026

Researcher Lukas Maar disclosed OEMPocalypse, a cross-OEM Android privilege-escalation technique targeting manufacturer-added kernel components rather than generic Linux kernel flaws or chipset drivers. The chains exploit a page use-after-free in an OEM kernel driver and, when SELinux restricts driver access, first use an OEM sandbox escape. A stale mapping to a freed physical page is then reclaimed to obtain page-level kernel-memory access and kernel-level compromise.

The technique reportedly avoids both a KASLR information disclosure and control-flow hijacking, limiting the effectiveness of several slab-allocation and CFI hardening measures. Its page-reclamation method was reported to function unchanged on Linux kernels 5.15 through 6.12, with tailored chains demonstrated against Samsung, Xiaomi, and Oppo software stacks on stock, locked-bootloader Galaxy S26 Ultra, Galaxy S26, Xiaomi 17, Oppo Find X9 Ultra, and OnePlus Ace 6 Ultra devices running July 2026 firmware.

Who uses this technique?Get the actors, campaigns, and ATT&CK mapping behind it.

Get the tradecraft

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

2 events · Aug 31, 2026

Reported Aug 31, 20262mo ago
Lukas Maar demonstrates OEMPocalypse Android exploit chains
Lukas Maar presented OEMPocalypse, separate Android exploit chains targeting OEM kernel components in Samsung One UI, Xiaomi HyperOS, and Oppo ColorOS. The chains reportedly achieved root-level compromise on five stock, locked-bootloader devices using July 2026 firmware, leveraging OEM sandbox escapes where needed and page use-after-free flaws in OEM drivers.
OEMpocalypse Now - Calif
Aug 31, 20263mo ago
OEMpocalypse research details OEM IPC and page-UAF exploit strategy
Lukas Maar published the first OEMpocalypse research installment, describing an optional logical flaw in OEM IPC endpoints to escape the untrusted_app domain followed by a page use-after-free in OEM kernel drivers for physical-memory read/write. The report included testing on locked-bootloader stock devices, including Samsung, Xiaomi, Oppo, and OnePlus models across Android 14 and 16.
OEMpocalypse : exploitation générique d'Android untrusted_app vers root sur Samsung, Xiaomi et Oppo | CyberVeille

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Affected products

2 linked

ColorosOne Ui

Organizations

6 linked

Samsung ElectronicsXiaomiOneplusOppoGuangdong OPPO Mobile TelecommunicationsOPPO Mobile Telecommunications

Do you run this?Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.

See Who Uses This Technique

Source coverage

Sources

3 references tracked. Mallory keeps watching after this page renders.

CyberveilleNews · Aug 31, 2026

OEMpocalypse : exploitation générique d'Android untrusted_app vers root sur Samsung, Xiaomi et Oppo | CyberVeilleOpen source ↗

Malware NewsNews · Aug 31, 2026

OEMpocalypse Now - Malware Analysis - Malware Analysis, News and IndicatorsOpen source ↗

Calif BlogNews · Aug 31, 2026

OEMpocalypse Now - CalifOpen source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

OEMPocalypse Exploit Chains Achieve Kernel Compromise on Major Android OEMs

How this story unfolded

Lukas Maar demonstrates OEMPocalypse Android exploit chains

OEMpocalypse research details OEM IPC and page-UAF exploit strategy

Related entities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Exploited Samsung Exynos Driver Flaw Enabled Android Kernel Privilege Escalation

Untrusted Android Apps Can Gain Root on OnePlus and OPPO Devices

Mali GPU Driver Flaws Enabled Root on Google Pixel Devices

OEMPocalypse Exploit Chains Achieve Kernel Compromise on Major Android OEMs

How this story unfolded

Lukas Maar demonstrates OEMPocalypse Android exploit chains

OEMpocalypse research details OEM IPC and page-UAF exploit strategy

Related entities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Exploited Samsung Exynos Driver Flaw Enabled Android Kernel Privilege Escalation

Untrusted Android Apps Can Gain Root on OnePlus and OPPO Devices

Mali GPU Driver Flaws Enabled Root on Google Pixel Devices