OEMPOCALYPSE NOW

Summary from the TLDR InfoSec newsletter

Calif researcher Lukas Maar has developed a universal exploitation strategy that elevates an unprivileged Android app to root across modern Samsung, Xiaomi, and Oppo devices. Rather than hunting for generic kernel or chipset vulnerabilities, Maar targeted the proprietary OEM software overlays, such as One UI and HyperOS, that span each vendor's entire device lineup. The exploit leverages a page use-after-free vulnerability mapped to a freed physical page. This reliable technique successfully bypasses KASLR, control-flow hijacking, and slab protections without modification across kernels 5.4 through 6.12. While this initial publication outlines the overarching methodology on locked bootloaders, Maar plans to release the specific exploit chains affecting July 2026 flagship devices like the Galaxy S26 Ultra in future installments.