Loading story…
Researcher Lukas Maar disclosed OEMPocalypse, a cross-OEM Android privilege-escalation technique targeting manufacturer-added kernel components rather than generic Linux kernel flaws or chipset drivers. The chains exploit a page use-after-free in an OEM kernel driver and, when SELinux restricts driver access, first use an OEM sandbox escape. A stale mapping to a freed physical page is then reclaimed to obtain page-level kernel-memory access and kernel-level compromise.
The technique reportedly avoids both a KASLR information disclosure and control-flow hijacking, limiting the effectiveness of several slab-allocation and CFI hardening measures. Its page-reclamation method was reported to function unchanged on Linux kernels 5.15 through 6.12, with tailored chains demonstrated against Samsung, Xiaomi, and Oppo software stacks on stock, locked-bootloader Galaxy S26 Ultra, Galaxy S26, Xiaomi 17, Oppo Find X9 Ultra, and OnePlus Ace 6 Ultra devices running July 2026 firmware.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Lukas Maar published the first OEMpocalypse research installment, describing an optional logical flaw in OEM IPC endpoints to escape the untrusted_app domain followed by a page use-after-free in OEM kernel drivers for physical-memory read/write. The report included testing on locked-bootloader stock devices, including Samsung, Xiaomi, Oppo, and OnePlus models across Android 14 and 16.
Lukas Maar presented OEMPocalypse, separate Android exploit chains targeting OEM kernel components in Samsung One UI, Xiaomi HyperOS, and Oppo ColorOS. The chains reportedly achieved root-level compromise on five stock, locked-bootloader devices using July 2026 firmware, leveraging OEM sandbox escapes where needed and page use-after-free flaws in OEM drivers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcemalware.news
Open sourceblog.calif.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A researcher disclosed a two-stage local privilege-escalation chain affecting OnePlus and OPPO devices running OxygenOS, including the OnePlus 15 on OxygenOS `16.0.3.503` and the OnePlus 12 Pro. A normally installable sideloaded app with no declared permissions can invoke the root-running `AtlasService` and inject shell commands through the `audiodumpinfo` debug service, obtaining execution as root in the SELinux `dumpstate` domain. The chain then abuses the Oplus Log Core (`olc2`) vendor HAL's UID-0-restricted `doShell` method to run commands in the `vendor_qti_init_shell` SELinux domain, whose bounding set includes all Linux capabilities. OnePlus reportedly confirmed in May that multiple products and software versions are affected, but no complete affected-device list, CVE identifier, remediation details, or evidence of exploitation in the wild had been published.
Sep 24, 2026
STAR Labs detailed two exploit chains showing how vulnerabilities in the Arm Mali GPU driver could be turned into full kernel compromise on Google Pixel phones. One write-up analyzed `CVE-2023-6241`, a race condition in `kbase_jit_grow` on a Pixel 8 running Android 14, where stale allocation state after a lock drop left some physical pages backed but unmapped. That inconsistency was used to trigger a page use-after-free, reclaim the freed page, and build arbitrary kernel read/write primitives. The exploit then overwrote kernel code to disable SELinux enforcement and invoked `commit_creds(&init_cred)` to gain root from the unprivileged `untrusted_app_27` context; STAR Labs said excessive `WARN_ON` logging initially stretched exploitation to about 10 minutes before testing reduced runtime to under five seconds. A second write-up showed that `CVE-2023-48409` alone was sufficient to compromise a Pixel 6 Pro, contradicting earlier assumptions that exploitation also required `CVE-2023-26083`. STAR Labs described the bug as an integer-overflow-driven out-of-bounds write in the Pixel Mali driver and said exploitation bypassed `CONFIG_HARDENED_USERCOPY` by targeting page-allocator-backed objects and using pagetable spraying techniques inspired by Dirty Pagetable. The researchers also mapped Android-specific constraints including seccomp, SELinux, and privilege-escalation mechanics, and found that while the earlier pointer-leak bug still existed on affected devices, the practical path relied on leaking a `kbase_context` object exposing a `task_struct` pointer for direct credential manipulation. Both reports said the affected issues were patched in later Android security updates.
Jun 29, 2026
Security researchers and vendors reported **hardware/firmware-level vulnerabilities in Android chip components** that can enable deep device compromise beyond typical app-layer defenses. Ledger’s Donjon research described a flaw involving **MediaTek chip boot-chain behavior and Trustonic’s trusted execution environment (TEE)** that allowed rapid physical compromise: by connecting an affected phone to a laptop over **USB**, attackers could allegedly brute-force the PIN, decrypt storage, and extract sensitive data including messages and **cryptocurrency wallet seed phrases** (e.g., Kraken Wallet, Phantom). The researchers estimated the affected MediaTek chips appear in roughly **one-quarter of Android phones**, disproportionately in lower-cost devices. Separately, Zimperium reported active exploitation of a **Qualcomm graphics zero-day** (**CVE-2026-21385**) in targeted Android attacks, describing a memory-corruption condition that could enable code execution or unauthorized access across “hundreds” of Qualcomm chipsets. A ZDNET article on Android’s *Repair Mode* primarily provides user guidance and anecdotal troubleshooting around a buggy March update/SIM recognition issue; it does not substantively address the chip-level vulnerabilities described in the other reporting and is best treated as tangential consumer advice rather than incident or vulnerability intelligence.
Jun 29, 2026