EL3vated Privileges: Glitching Google Wifi Pro From Root To EL3

Goal: root to EL3

Researchers use electromagnetic fault injection (EMFI) on Google Wifi Pro to escalate from compromised Linux root to ARM EL3—the highest secure-world privilege on TrustZone-based devices. The work continues a theme of relating energy perturbation to computing state at the hardware level.

Boot chain and storage access

The device boot flow runs ROM, signed secondary bootloader (SBL) at EL3, Qualcomm secure OS, U-Boot, then Android. By locating eMMC clock signals and removing a capacitor, they mounted internal flash in Linux, dumping 19 partitions including A/B SBL and U-Boot copies used for resilient updates.

Glitching path to EL3

With firmware dumped and boot stages mapped, EMFI targets critical verification or execution points to fault secure boot or trust-zone transitions. Achieving EL3 breaks assumptions that kernel compromise is the ceiling, showing consumer mesh routers still expose high-value silicon attack surfaces.