CVE-2025-8045

CVE-2025-8045 — Arm Mali GPU KCPU Queue UAF A local privilege escalation exploit for CVE-2025-8045 , a use-after-free in the Arm Mali GPU kernel driver kbase. A non-privileged local process races the CSF KCPU queue dump path to free and reclaim a cpuqueue.buffer, turns the dangling allocation int...

Google-Tensor-Chips

Google Tensor Chips — DarWINN NPU Access Direct-access tooling for the Google Tensor NPU DarWINN, reverse-engineered across two generations: Tensor G2 Pixel 7, codename Janeiro and Tensor G3 Pixel 8, codename Rio. Why this exists I was trying to get LLM inference running on the phone and wanted t...

qu1ckr00t

qu1ckr00t A PoC application demonstrating the power of an Android kernel arbitrary R/W CVE-2019-2215. Writeup: https://hernan.de/blog/2019/10/15/tailoring-cve-2019-2215-to-achieve-root/ Qu1ckR00t is a PROOF OF CONCEPT. It should NOT be used on your personal device with valuable userdata. It has...

CVE-2022-20607

CVE-2022-20607 In the Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with LTE authentication needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID:...

CVE-2019-2215

CVE-2019-2215 Android Kernel Vulnerability CVE-2019-2215 temporary root PoC. It works on Google Pixel 2/Pixel 2 XL walleye/taimen devices running the September 2019 QP1A.190711.020 image with kernel version-BuildID 4.4.177-g83bee1dc48e8. Usage Now, Binary support arm64 only. $ git clone...

Pixel_GPU_Exploit

Mali GPU Kernel LPE This article provides an in-depth analysis of two kernel vulnerabilities within the Mali GPU, reachable from the default application sandbox, which I independently identified and reported to Google. It includes a kernel exploit that achieves arbitrary kernel r/w capabilities...

root-exploit-pixel3

Root Exploit for Pixel 3 Family This folder contains a local privilege escalation exploit, a modification of the bluefrostsecurity PoC for CVE-2020-0041. The exploit disables SELinux and then launches a root shell. The exploit was provided with hardcoded offsets for a Pixel 3 device running the...

CVE-2023-6241-Pixel7_Adaptation

CVE-2023-6241 for Google Pixel 7 This repository will illustrate how to adapt the exploit published by securitylab in its GitHub repository working for Google Pixel 8 for a Google Pixel 7. Before starting the modification of the exploit, the assumption that the original exploit was also working f...

PixelDump_CVE-2016-8462

PixelDump - CVE-2016-8462 PixelDump CVE-2016-8462 was one of Pixel bootloader vulnerabilities found/worked out by beaups and Jon 'jcase' Sawyer. Disclaimer This is a dirty POC that was never intended to be released, I just copied another project, spent a few minutes adding a few lines, and sent i...

bad_io_uring

Bad IOuring https://www.blackhat.com/us-23/briefings/schedule/index.htmlbad-iouring-a-new-era-of-rooting-for-android-32243 Build the exploit Make sure the Android NDK is installed. For pixel 6, make pixel For samsung s22, make s22 How to use the exploit The exploit is written to support different...

dangerzone

Dangerzone Take potentially dangerous PDFs, office documents, or images and convert them to a safe PDF. | ---|--- Dangerzone works like this: You give it a document that you don't know if you can trust for example, an email attachment. Inside of a sandbox, Dangerzone converts the document to a PD...

pixel-ksu-root

pixel-ksu-root Root a stock, locked-bootloader Google Pixel from an unprivileged adb shell, using a kernel CVE — no unlock, no flash, no vendor help. A userspace-reachable kernel bug yields a short-lived read/write primitive. That primitive is spent late-loading a KernelSU module into the running...

PixelCode-Attack

Malicious PixelCode Delivery Technique Malicious PixelCode is a security research project that demonstrates a covert technique for encoding executable files into pixel data and storing them inside images or videos. A lightweight loader retrieves the media file, reconstructs the original binary, a...

PTP-RAT

PTP-RAT Exfiltrate data over screen interfaces More information about how the tool works can be found at https://www.pentestpartners.com/security-blog/exfiltration-by-encoding-data-in-pixel-colour-values/...

CVE-2018-9411

CVE-2018-9411 Exploit code for CVE-2018-9411 for MediaCasService. Note that this exploit is only provided for educational or defensive purposes; it is not intended for any malicious or offensive use. Full write-up for the vulnerability and the exploit is available on the Zimperium blog. If you ha...

build.prop

Pixel Prop Builder: Streamlined OTA to Build.prop Conversion Effortlessly extract and manage system properties from Pixel OTA updates with this robust automation suite. Designed for developers and enthusiasts alike, it simplifies the process of accessing and customizing Android build properties. ...

DirtyPipe-Android

DirtyPipe for Android Dirty Pipe CVE-2022-0847 temporary root PoC for Android. Targets Currently only run on Pixel 6 with security patch level from 2022-02-05 to 2022-04-05. Don't use on other devices or other versions. It must crash reboot. Dirty Pipe is finally patched on 2022 May security upda...

CVE-2026-0163-EXP

CVE-2026-0163 DISCLAIMER This repository is for educational and research purposes only. The author is not responsible for any misuse, damage, or illegal activities caused by the use of this material. Use at your own risk. Respect applicable laws and ethical guidelines. Overview A functional remot...

CVE-2019-14041

CVE-2019-14041 Proof-of-concept code for CVE-2019-14041 More details about the vulnerability are available in the blog post. If you have any questions, you are welcome to DM me on Twitter @tamirzb. Build & Run In order to build, run Android NDK's ndk-build. In order to run the PoC, make sure to r...

CVE-2026-2828-WebGPU-Cross-Origin-Pixel-Stealing-via-Timing

4. CVE-2026-2828 – WebGPU Cross‑Origin Pixel Stealing via Timing Overview A malicious website uses WebGPU compute shader timing to measure rendering time of a cross‑origin iframe, recovering pixel values of sensitive content e.g., banking details. Severity: High Information Disclosure...