OEMpocalypse chains achieve page UAF root on Samsung S23-S26 series via targeted driver exploits

The strategy isolates all bugs to OEM-written code rather than generic Linux or chipset paths, bypassing DAC, SELinux, and seccomp restrictions that normally limit untrusted_app domains. A sandbox escape first reaches the privileged SELinux domain guarding the target driver, after which the page UAF supplies a stable physical-page primitive independent of KASLR, CFI, and slab hardening. This yields near-100 percent reliability across device variants with minimal per-model adjustment. Three instantiations cover all tested Samsung flagships from S23 through S26 and recent Z-series units, a large share of Xiaomi mid-range to flagship SoCs, and recent Oppo/OnePlus/Realme flagships. Each chain was validated on bootloader-locked hardware, confirming end-to-end execution from unprivileged app to root without chipset-specific primitives. Prior Android exploit literature focused on upstream kernel or Qualcomm/ MediaTek drivers; OEMpocalypse instead exploits the fact that vendor SELinux policies and custom drivers create new, less-audited attack surfaces. The approach trades generic coverage for higher portability and resistance to kernel hardening that has neutralized many older techniques. Subsequent posts will release the full technical details of each chain. Device vendors will likely respond with driver updates and SELinux tightening within one to two quarterly security bulletins once the reports land.