Zero-Permission Android Apps Exploit Manufacturer Code
An entirely ordinary Android application, devoid of any requested permissions, can now seize absolute control over contemporary flagship smartphones. Calif researcher Lucas Maar brilliantly demonstrated a devastating attack vector targeting devices from Samsung, Xiaomi, Oppo, and OnePlus. Astonishingly, this exploit functions perfectly on smartphones operating with locked bootloaders and factory-standard firmware, effectively elevating an unprivileged application into an omnipotent process possessing maximum systemic rights.
The Architecture of OEMpocalypse Now
This ingenious methodology is designated “OEMpocalypse Now.” The most critical detail regarding this research is that Maar did not simply uncover a singular, universal flaw affecting all smartphones simultaneously. Instead, the researcher architected a unified exploitation strategy. Upon this robust foundation, he constructed three distinct exploit chains specifically tailored for Samsung, Xiaomi, and the broader Oppo family (which intrinsically includes both OnePlus and Realme devices). This sophisticated approach allows an attacker to port the exploit across a vast multitude of models from a single manufacturer with significantly reduced developmental effort.
The practical demonstrations featured an impressive array of top-tier hardware: the Galaxy S26 Ultra and Galaxy S26 running Android 16, the Galaxy S23 on Android 14, the Xiaomi 17, the Oppo Find X9 Ultra, and the OnePlus Ace 6 Ultra. These smartphones utilized diverse processing architectures, including the Qualcomm Snapdragon, Samsung Exynos, and MediaTek Dimensity, while their underlying Linux kernel versions ranged broadly from 5.15 to 6.12. Crucially, the Galaxy S26, Xiaomi 17, Oppo Find X9 Ultra, and OnePlus Ace 6 Ultra were all operating on their stock firmware fortified with the July 2026 security updates, which represented the absolute latest available patches during the testing phase in early August.
Exploiting the Vendor Overlay
Maar consciously abandoned the traditional pursuit of discovering flaws within the core Android operating system or specific hardware processors. Instead, his primary objective became the proprietary code that manufacturers layer indiscriminately on top of Android. This includes their bespoke system services, proprietary applications, and the specialized drivers powering interfaces like One UI, HyperOS, and ColorOS. Frequently, a single such component is deployed identically across dozens of distinct smartphone models featuring wildly different processors. Consequently, uncovering a vulnerability within these shared components yields a massively amplified attack surface.
The Two-Stage Exploitation Process
The attack systematically unfolds in two distinct stages. Initially, the malicious application shatters the confines of the systemic sandbox. It achieves this by exploiting an error within the interaction mechanism governing communication with a privileged manufacturer component. The root cause might stem from a failure to verify the calling process, an improperly exposed systemic component, or woefully inadequate file path validation. Once this illicit access is secured, the application can directly interface with a kernel driver—a profound capability that a standard application should never natively possess.
The subsequent stage ruthlessly leverages a “use-after-free” vulnerability residing deep within the manufacturer’s proprietary driver. The flawed driver erroneously retains a pointer to a specific page of physical memory long after that memory has been formally deallocated. Meanwhile, the operating system inevitably reallocates that exact memory segment for other, critical kernel data. The exploit then seizes the opportunity to read or manipulate the contents of this repurposed memory page, ultimately achieving catastrophic root access.
In a detailed breakdown of OEMpocalypse Now, Maar explained that this approach proved remarkably resilient against several intrinsic Android defense mechanisms. The sophisticated code responsible for reusing the freed memory pages functioned flawlessly, without necessitating any modifications, across kernel versions 5.15 through 6.12. Furthermore, the technique largely circumvents the protections afforded by the memory allocator, KASLR, and standard control-flow integrity mechanisms. The researcher steadfastly aimed to achieve near 100 percent reliability across all compatible devices, although the precise scope is ultimately dictated by the specific constellation of components installed by the individual manufacturer.
Scope, Mitigation, and Future Disclosures
Regarding Samsung, the research definitively encompasses at least the flagship Galaxy S23, S24, S25, and S26 models, alongside the contemporary foldable devices within the Z series. For Xiaomi, Maar estimates that the vulnerable components are heavily present across a substantial portion of their mid-range and premium smartphone portfolios. This identical strategy extends predictably to modern flagships produced by Oppo, OnePlus, and Realme. Notably, Google Pixel smartphones, which maintain an architecture closely mirroring stock Android, do not fall victim to this specific scheme, as the attack explicitly targets extraneous manufacturer code.
The official September Samsung security bulletin separately lists two distinct vulnerabilities discovered by Maar within the DualDAR component. CVE-2026-21101 involves the driver executing incorrect validation of input data. Meanwhile, CVE-2026-21102 represents a classic use-after-free scenario, empowering a privileged local process to execute arbitrary code with devastating root privileges. Both critical issues afflicted Samsung devices running Android 14, 15, 16, and 17 prior to the installation of the September patch compilation. The author has not yet fully disclosed the intricate relationship between the DualDAR vulnerabilities and the demonstrated OEMpocalypse exploit chain.
Currently, a weaponized, readily available exploit does not exist within the public domain. While Maar has published video recordings verifying the successful attacks, he deliberately chose to withhold the technical minutiae of the specific exploit chains until subsequent installments of his research, which will address Samsung, Xiaomi, and the Oppo family individually. Therefore, the current publication brilliantly illustrates the underlying principle and the terrifying potential scope of the attack, without providing a turnkey tool for hacking smartphones.
The paramount conclusion drawn from this research does not indict Android as a platform, but rather severely criticizes the proprietary manufacturer code endowed with excessive systemic privileges. These supplementary drivers and bespoke services drastically expand the attack surface. When plagued by errors, they possess the catastrophic capability to completely negate multiple, robust layers of Android’s core defenses. For the end user, practical defensive strategies remain unchanged: install system updates immediately upon release and absolutely refrain from installing applications originating from dubious sources, as the attacker fundamentally requires the execution of an application on the target device to initiate the demonstrated exploit chains.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
