We discovered a privileged process arbitrary code execution vulnerability in Android 17. This vulnerability was patched in Android 17 QPR1 but was not included in any security bulletin. Combined with the dirty frag vulnerability (CVE-2026-43284), we achieved full root privilege escalation on Android 17.0.

The DirtyFrag vulnerability was disclosed 3 months ago but is still exploitabe, because Google has delayed the release frequency of vulnerability patches, changing from monthly to quarterly security bulletins. In the AI ​​era, this behavior is completely incomprehensible. A large number of devices in the Android ecosystem are vulnerable to attacks due to the vulnerability details leaked in the Pixel system; even Pixel devices not participating in the beta program are not immune.

Therefore, we used two "already patched" vulnerabilities to demonstrate full rooting on Google Pixel 10 with the latest patches as a warning, urging Google to change its practices and release vulnerability patches promptly.

Xiaomi Dialer & Contacts port (HyperOS 3) for AOSP
Ported by Islam AlorabI
Telegram: @IslamAlorabI
Channel: @Shadow6by8

Source: Xiaomi 15 Global, HyperOS 3.0.303.0 (Android 16)

• Install: KernelSU / Magisk module (requires a mount metamodule on KernelSU 3+)
• It should work on Android 15/16; otherwise, it is unknown and requires your testing. Set the "Phone" app as default to ensure it works properly.

Note: This is a test build intended for testing and is not yet stable for daily use. Test everything and report bugs with logs