ADB-Enabled Exploit Unlocks Bootloader, Grants Persistent Root…

A public exploit package for the third-gen Amazon Fire TV Cube (codename gazelle) chains CVE-2026-43499 (Ghostlock) with a separate bootloader flaw to achieve persistent root via Magisk, TWRP recovery, unlimited fastboot, and USB boot. The attack requires local ADB access enabled and authorized, and works on firmware PS7717 or earlier. It is not a remote, unauthenticated attack.

A public exploit package released on September 30, 2026 grants persistent root access and bootloader unlock on the third-generation Amazon Fire TV Cube, codenamed "gazelle." Developed by XDA member Pro-me3us and now at version 1.2, the method works on firmware up to release PS7717. It requires local ADB access that is both enabled and authorized; this is not a remote, unauthenticated attack.

Key Takeaways

Exploit package v1.2 enables persistent root via Magisk, TWRP recovery, unlimited fastboot, and USB boot on Fire TV Cube 3 running firmware PS7717 or earlier.
The chain combines CVE-2026-43499 (Ghostlock) for temporary privilege escalation with a separate bootloader vulnerability discovered by John Red.
The process requires ADB enabled and authorized; it automatically performs a factory reset and disables automatic OTA updates.
Incorrect modification of the logo partition causes a permanent "hard brick"; running the temporary root tool twice in a single boot triggers a crash and forced reboot.

The Technical Chain: From ADB to Boot Control

Entry requires the device to have ADB debugging enabled and authorized. From there, the exploit leverages CVE-2026-43499, dubbed Ghostlock, to obtain temporary root. The port is the work of mforce2, building on the original chain from NebuSec. This escalation triggers the second phase: a bootloader vulnerability identified by John Red that unlocks the chain of trust below the Android layer.

The result is a device with a compromised trust chain: persistent root access via Magisk, TWRP recovery, Amlogic download mode, U-Boot netconsole over Ethernet, USB boot, and multiboot with alternative systems such as CoreELEC and EmuELEC. The package requires 1.5 GB of free user space to maintain the unlock and automatically performs a factory reset, wiping user data.

Cybernews reports that CVE-2022-38181, a vulnerability in the ARM Mali GPU kernel driver with a CVSS score of 8.8, was used by Man Yue Mo for information gathering and testing during research, but it does not constitute the active mechanism of the current exploit chain. ARM released the patch for CVE-2022-38181 on August 12, 2022; the Fire TV Cube 3 launched on October 25, 2022. The brief does not clarify whether the vulnerable driver was present at launch or if the patch was integrated; the question remains unresolved between a missed patch and possible reintroduction.

Amazon's Response: Deliberate Access, Limited Risk

Amazon responded with a scoped risk assessment. A spokesperson quoted by Cybernews stated: "What's being demonstrated poses little risk to customers; it's someone modifying a device they own to run unofficial software, which requires direct physical access and a deliberate, multi-step process." The company added it is "reviewing details for appropriate action," without confirming or denying a commitment to release a firmware update.

Bootloader unlock disables OTA updates, eliminating automatic receipt of future security patches. This condition is irreversible without manual intervention and represents a security tradeoff for the user who chooses to apply the exploit.

"DO NOT modify the logo partition, it is used to maintain the unlock... doing so will likely hard brick your Cube" — Pro-me3us, XDA Forums instructions

The ARM Driver Context and Patch Uncertainties

The presence of CVE-2022-38181 in the research context, despite the ARM patch predating the device launch, highlights a documented fracture in the IoT ecosystem: upstream fixes for ARM components do not always translate into timely updates for final devices. The brief does not specify whether the driver was patched at the Cube 3's launch, nor whether a subsequent reintroduction made the vulnerability present again.

Pro-me3us commented: "Once patched, I don't expect another gazelle unlock opportunity." The quote, reported by Cybernews, expresses the developer's personal expectation about future closure of the vulnerability, not a confirmation of a patch in progress. At present, no source documents an update for firmware PS7717+ or a release timeline.

What Changes

For Fire TV Cube 3 users, the case presents three concrete conditions:

Verify ADB status: Debugging must be disabled on devices not intended for development, as it is the necessary prerequisite for the entire exploit chain.
Assess installed firmware: Package v1.2 is documented as working on PS7717 or earlier; the brief does not specify whether later versions are vulnerable.
Recognize the permanent brick risk: Modifying the logo partition or errors in the process can render the device unrecoverable.

No source reports evidence of malicious exploitation in the wild. The method remains confined to conscious modding contexts, with security risk deriving primarily from the loss of automatic updates.

Source Limitations and Editorial Notes

This article is based on reporting from editorial aggregators and community forum threads, without structured vendor sources or formal security advisories. No ZDI, GHSL, or Amazon advisories are available. Technical information originates from XDA Forums, with correspondence across multiple cybersecurity news sites reporting the same details with consistent attribution.

The brief does not specify whether CVE-2026-43499 has a confirmed CVSS score or an NVD record. It is unknown whether John Red's bootloader vulnerability has a separate CVE identifier. The number of devices actually unlocked or at risk is not documented in available sources.

Information has been verified against cited sources and is current as of publication.

Sources

Sources and references

Get DeafLetter