Part 1 of a series detailing a generic exploitation strategy to achieve root from an unprivileged Android app on Samsung, Xiaomi, and Oppo/OnePlus/Realme devices. Researchers typically develop five distinct strategies to escape the untrusted_app sandbox, each with trade-offs. This strategy focuses exclusively on code written by Original Equipment Manufacturers (OEMs).

The core approach targets a page Use-After-Free (UAF) vulnerability in an OEM-specific kernel driver. A sandbox escape bug is used first to cross privilege boundaries where the OEM's SELinux policy permits access. The appeal of this method lies in its stability; a page UAF reached from the correct context can provide a physical page-level primitive that remains largely independent of kernel version, slab hardening, KASLR, CFI, and the specific phone model.

Three instantiations of the strategy were executed, covering all Samsung flagship devices from the Galaxy S23 through S26 series and the recent Z series, a large share of Xiaomi mid-range to flagship devices, and recent Oppo, OnePlus, and Realme flagship devices. The subsequent posts in the series will provide the technical details of these chains. Overview sections examine the Android kernel attack surface, distinguishing between generic Linux kernel vulnerabilities, chipset drivers, and the OEM-specific code targeted by this approach.