Android OEM chains turn untrusted apps into root

Lukas Maar presents a two-stage strategy for escalating from Android’s untrusted_app domain to root on stock devices with locked bootloaders. The approach targets OEM-specific code and was demonstrated across Samsung, Xiaomi, Oppo, OnePlus, and Realme devices; the affected components, ioctl sequences, and exploit code are not public.

• OEM IPC sandbox escape — A missing caller check, unnecessarily exported component, or unvalidated file path lets an unprivileged app reach an OEM process whose SELinux domain can access the target driver. This stage is required when the driver is not directly reachable from untrusted_app.

• Page use-after-free in an OEM kernel driver — The driver releases a physical page while a CPU or device mapping remains active. After the page is reused for a page table or another kernel object, the stale mapping provides kernel memory read/write access, enabling changes to security-sensitive state and escalation to root.

The chains were packaged as ordinary Android apps with no declared permissions and demonstrated on stock signed images with Verified boot: green, Bootloader lock: 1, and VBMeta state: locked. The article does not provide a CVE identifier or reproducible PoC, and independent reproduction is currently unavailable.

Article: https://calif.io/research/oempocalypse