OEMpocalypse Now
Brief
Our own Lukas Maar spent months pursuing one question: How do you turn a normal Android app into root access across as many phones as possible without rewriting the exploit for every model?
Generic Linux kernel bugs offer broad coverage: one exploit can target both Pixel and Galaxy. But bugs that survive years of auditing often provide only constrained slab-level primitives, forcing the exploit into heap grooming and per-device tuning.
Chipset drivers offer stronger primitives. A GPU or DSP driver pins and maps entire pages for the device, giving the attacker page-level access. But coverage follows the silicon, and each OEM ships several chipsets across its lineup.
Lukas chose a third target: the code Samsung, Xiaomi, and Oppo build on top of Android.