Wenxiang Qian - Breaking Google Home: Exploit it with SQLite

Google Home SQLite Exploitation

Wenxiang Qian (Security Researcher, Tencent Blade Team) presents a complete exploit chain for achieving remote code execution on Google Home smart speakers through SQLite vulnerabilities.

Attack Vector: Local Network SQLite Injection

Google Home exposes a local REST API for device discovery and setup. A SQLite database stores device configuration. Qian identifies a SQL injection vulnerability in a specific API endpoint that allows injecting arbitrary SQLite queries.

SQLite as an Exploitation Primitive

Exploiting a SQLite vulnerability for code execution is unconventional. Qian demonstrates using SQLite's LOAD_EXTENSION feature to load arbitrary shared libraries, and uses a UAF (use-after-free) vulnerability in SQLite's virtual table implementation as a memory corruption primitive for ASLR bypass and shell execution.

Full Chain and Impact

The complete exploit chain achieves root shell access on the Google Home from the local network — allowing persistent access to the always-listening microphone, home network traffic interception, and lateral movement to other Google-connected devices.