TiYunZong Exploit Chain to Remotely Root Modern Android Devices - Pwn Android Phones from 2015-2020

Overview: Guang Gong, team leader of 360 Alpha Lab, presents TiYunZong, a 1-click remote exploit chain that compromised the Google Pixel 4. Gong analyzes the remote attack surface of modern Android devices and shares insights from multiple successful Mobile Pwn2Own competitions. The talk explains how three zero-day vulnerabilities across Chrome V8, Chrome IPC/media components, and Qualcomm GPU kernel drivers were chained together to gain remote root execution without using Return-Oriented Programming (ROP).

Key Topics: - Android exploit surface analysis (remote Internet vs. adjacent network vectors) - Evolution of Mobile Pwn2Own Android exploit chains from 2015 to 2020 - Chrome V8 out-of-bounds access in Torque code (CreateDerivedMap and Proxy) - Chrome sandbox escape (CVE-2019-5870 UAF) and Qualcomm KGSL kernel privilege escalation (CVE-2019-10567)

Technical Details: Guang Gong contrasts adjacent network attack vectors (Bluetooth, Wi-Fi, baseband, NFC) with Internet-based vectors (browsers, messaging, email). While Google Pixel devices feature rapid security patches and strict SELinux isolation, 360 Alpha Lab engineered TiYunZong ("Stairs of Clouds"), a 1-click full-chain remote root that won the highest reward in Google VRP history in 2019. Gong reviews previous Mobile Pwn2Own successes: a 2015 Nexus 6 V8 RCE converted to UXSS on Google Play; a 2016 unsandboxed WebView bypass; a 2017 Samsung Galaxy S8 browser OOB and gralloc UAF chain; and a 2018 Pixel Chrome V8 RCE chained into system_server.

The TiYunZong chain comprises three vulnerabilities executed sequentially upon opening an attacker's web link in Google Chrome, achieving a root reverse shell without ROP:

1. Chrome V8 Remote Code Execution: In V8's heap memory layout, JSFunction objects allocate a prototype_or_initial_map slot (64 bytes) if they are constructors, or omit it (56 bytes) if they are regular functions. The built-in Proxy function is an anomaly: it is marked as a constructor but lacks this slot. The Torque macro CreateDerivedMap failed to verify whether new_target contained prototype_or_initial_map, causing out-of-bounds heap access. Attackers triggered this via a single line of JavaScript calling Reflect.construct on a typed array with new_target set to Proxy, achieving renderer RCE.

2. Chrome Sandbox Escape (CVE-2019-5870): The compromised renderer is confined to the isolated_app SELinux domain, preventing direct interaction with GPU drivers. To escape, the exploit triggered CVE-2019-5870, a Use-After-Free in Chrome's media component via Mojo IPC calls, executing code in Chrome's privileged browser process running in untrusted_app.

3. Kernel Privilege Escalation (CVE-2019-10567): From untrusted_app, the exploit interacted with Qualcomm's Kernel Graphics Support Layer (/dev/kgsl-3d0). By triggering CVE-2019-10567 in the KGSL driver, the exploit corrupted kernel memory and overwrote process credentials, elevating privileges to root.

Key Takeaways: Mobile defense-in-depth requires securing internal IPC boundaries as well as outer perimeters. Privileged browser broker processes running in broader SELinux domains (untrusted_app) act as stepping stones between sandboxed renderers and vulnerable hardware drivers. Securing Android requires auditing DSL code generators (like V8 Torque), rigorous IPC validation, and restricting vendor driver access (/dev/kgsl) from application contexts.

(AI summary — Gemini Flash)