Hazel Fire TV temporary root

Temporary root exploit for the Amazon hazel Fire TV platform, based on CVE-2026-43499. The exploit is is intended for the ARM32 Linux 4.9 firmware shared by Hazel televisions from several manufacturers. Profiles currently cover firmware from PS7657.3645N through PS7716.5665N.

The current hardware-tested configuration is:

Device	Toshiba Fire TV (hazel)
Fire OS build	PS7716.5665N
Kernel	Linux 4.9.113
Product Model	AFTHA004 (C350)

[!WARNING] This exploit remains firmware-specific even though it supports multiple Hazel releases. Kernel addresses, structure offsets, and reclaim settings are loaded from strict profiles. PS7716.5665N is hardware-tested; the older bundled profiles are based on static firmware analysis and still need reports from matching televisions.

Do not bypass profile matching or hand-copy addresses to an unrelated firmware. Statically generated profiles still require confirmation on matching hardware.

A failed heap reclaim may panic and reboot the TV. Root is temporary and is lost after reboot. If your TV freezes, you can always power cycle it.

What it does

The exploit uses CVE-2026-43499 to obtain temporary UID 0 from the normal ADB shell environment.

The exploit chain includes:

• ARM32 futex-PI UAF exploitation
• kernel address leak
• mm_struct cross-cache reclaim
• controlled kernel object reclaim
• kernel read/write primitives
• current task discovery
• credential patching
• a local root command server/client
• strict firmware profile selection and post-read runtime validation

After a successful run, the exploit keeps the kernel objects required by the root path alive and starts a local command daemon.

SELinux remains Enforcing. Commands executed through the root daemon retain the shell SELinux domain and the capability bounding set available on this firmware.

Files

• hazel_root.c main exploit, kernel read/write stage, credential patching, and root command client/server
• hazel_reclaim.h kernel address leak and mm_struct cross-cache reclaim
• hazel_profile.c, hazel_profile.h strict profile parser and runtime matcher
• profiles/ reviewed and generated firmware profiles
• tools/profile_creator/ Python/uv firmware analyzer and compatible-profile creator
• tools/device_scripts/ optional OTA, Amazon service, and launcher utilities

Requirements

• ADB
• Android NDK r27d
• ADB debugging enabled on the TV
• a host capable of building an ARMv7 Android executable

The examples below assume Linux and that adb is available in $PATH.

Build (optional)

Set NDK to your Android NDK r27d directory:

export NDK=/path/to/android-ndk-r27d

Then compile:

"$NDK/toolchains/llvm/prebuilt/linux-x86_64/bin/clang" \
    --target=armv7a-linux-androideabi28 \
    -O2 -g0 -Wall -Wextra -Wpedantic -fPIE -pie \
    hazel_root.c hazel_profile.c -o hazel_root \
    -pthread

Install

Connect to the TV using ADB.

If using network ADB:

adb connect <TV_IP>:5555

Push the exploit:

adb shell mkdir -p /data/local/tmp/profiles
adb push hazel_root /data/local/tmp/hazel_root
adb shell chmod 755 /data/local/tmp/hazel_root
adb push profiles/. /data/local/tmp/profiles/

Check profile selection without triggering the exploit:

adb shell 'cd /data/local/tmp && ./hazel_root --check-profile'

The loader requires exact matches for ro.product.device, build fingerprint, incremental version, kernel release, and architecture. It refuses malformed profiles, unknown fields, unsupported exploit paths, missing matches, and multiple matching profiles. An explicit profile can be checked with:

adb shell 'cd /data/local/tmp && ./hazel_root --check-profile --profile profiles/PROFILE.conf'

Run

Start from a clean boot:

adb shell 'cd /data/local/tmp && ./hazel_root'

A successful run ends with output similar to:

[root] uid=0 euid=0 gid=0
[ROOT] uid=0 daemon pid=... socket=@hazel_root

The reclaim is probabilistic. An unsuccessful attempt may fail cleanly or panic and reboot the TV.

If the TV reboots, let it boot normally and try again.

Once the exploit succeeds, do not launch another copy. You can close the running process, and proceed with the next commands.

Run commands as root

The same binary acts as a client for the root daemon:

adb shell 'cd /data/local/tmp && ./hazel_root --client id'

For example:

adb shell 'cd /data/local/tmp && ./hazel_root --client getenforce'
adb shell 'cd /data/local/tmp && ./hazel_root --client cat /proc/self/status'
adb shell 'cd /data/local/tmp && ./hazel_root --client "id; uname -a"'

A successful root command should report:

uid=0(root) gid=0(root) context=u:r:shell:s0

Note that UID 0 does not bypass SELinux. SELinux remains Enforcing.

Disable OTA updates

Push and run tools/device_scripts/disable_ota.sh through the root daemon:

adb push tools/device_scripts/disable_ota.sh /data/local/tmp/disable_ota.sh
adb shell chmod 755 /data/local/tmp/disable_ota.sh
adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_ota.sh"'

The script disables both Fire OS OTA packages, clears pending updater state, and verifies the resulting Package Manager state. It does not reboot the TV.

Disable Amazon package enforcement, ACR, and metrics

tools/device_scripts/disable_amazon_services.sh disables the Arcus remote-configuration proxy, the ADEP application-blocking service, Automatic Content Recognition (ACR), and the dedicated Amazon metrics packages present on the tested Hazel firmware. ACR is disabled and its stored data is cleared, but its read-only system APK is not deleted, making the operation reversible. The script does not disable CrashManager or the low-level logging packages, so kernel panic and Dropbox diagnostics remain available while developing or troubleshooting the exploit.

Push the script and run it through the root daemon:

adb push tools/device_scripts/disable_amazon_services.sh /data/local/tmp/disable_amazon_services.sh
adb shell chmod 755 /data/local/tmp/disable_amazon_services.sh
adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_amazon_services.sh"'

Show the current state without changing anything:

adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_amazon_services.sh status"'

Restore the packages later if required:

adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/disable_amazon_services.sh restore"'

The enabled or disabled package state normally survives a reboot. Restoring the packages does not restore the package data cleared while disabling them.

Launcher helpers

The launcher scripts are also in tools/device_scripts/. To select Projectivy:

adb push tools/device_scripts/set_projectivy_launcher.sh /data/local/tmp/set_projectivy_launcher.sh
adb shell chmod 755 /data/local/tmp/set_projectivy_launcher.sh
adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/set_projectivy_launcher.sh"'

To restore the stock launcher:

adb push tools/device_scripts/restore_stock_launcher.sh /data/local/tmp/restore_stock_launcher.sh
adb shell chmod 755 /data/local/tmp/restore_stock_launcher.sh
adb shell 'cd /data/local/tmp && ./hazel_root --client "sh /data/local/tmp/restore_stock_launcher.sh"'

Recovery

Reboot the TV:

adb reboot

The exploit only modifies temporary kernel state, so root is lost after reboot.

Changes deliberately made to persistent Android settings or data while root was active are, of course, not necessarily reverted by rebooting.

Firmware profiles