LSPromise Exploit Chain Enables Complete Android Rooting

Researchers recently published the LSPromise exploit chain, demonstrating a complete path from a local untrusted app to full kernel control. This severe flaw impacts devices running the initial Android 17 official release. Importantly, the details of the vulnerability and the proof-of-concept exploit code have been publicly disclosed.

Why This Threat Matters

The LSPromise exploit chain represents a critical risk to Android users because it achieves a 100% success rate on vulnerable devices. Unlike memory corruption exploits that rely on complex heap spraying, this chain bypasses mitigations like KASLR and MTE entirely. By chaining together a logic error and an older kernel flaw, attackers can silently escalate privileges and load unauthorized kernel modules. This level of access allows an attacker to bypass all platform security models, including SELinux.

How the Attack Works

First, the exploit leverages CVE-2026-49881, a simple logic bug introduced in Android 17 within the Telecom service. According to the advisory, the vulnerable code uses specific flags “to load code from an arbitrary app.” Even though the system attempts to prevent class initialization, an attacker can declare a custom component that invokes malicious code upon class loading. This grants execution within the highly privileged system_server process.

Next, the attacker must bypass SELinux restrictions to execute native code. The exploit uses Java reflection to retrieve application handles from the Activity Manager. The attacker then forces the network stack process, which has the necessary permissions, to load their native code. Finally, the attacker exploits CVE-2026-43284, a known “DirtyFrag” kernel vulnerability. By systematically patching system libraries like libc.so and manipulating process transitions, the attacker ultimately loads a malicious kernel module. The attacker then sets SELinux to permissive, achieving full root access.

Affected Versions

This exploit was successfully tested on a Pixel 10 running the initial Android 17 release. Furthermore, other devices utilizing the 6.1.xxx-android14 kernel trees might also be vulnerable to the DirtyFrag component. The researchers confirmed that the exploit does not function on the Pixel 6a.

Patch and Mitigation Steps

Google resolved the userspace logic error, CVE-2026-49881, in September 2026. Therefore, users must immediately update their Android devices to the latest security patch level to break the first stage of the LSPromise exploit chain. Currently, no other mitigation exists besides applying the official manufacturer updates.

Technical details and proof-of-concept

This premium content is securely locked. You must upgrade your subscription to access the full threat intelligence report, including detailed mitigation steps, deep-dive analysis, and active exploitation metrics. Your attempt to inspect the DOM will only reveal this placeholder text. Please support our work to read the actual coverage.

Unlock Premium Threat Intelligence

This is a premium content. Upgrade to Pro or Team to unlock full access and remove all reading restrictions.

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.