Chronomaly — CVE-2025-38352 on LG webOS
CVE-2025-38352 kernel exploit for LG webOS Smart TVs (ARM64). Achieves persistent root on real consumer hardware with novel exploitation techniques. Responsibly disclosed to LG.
- Root exploit
- Stable
- Medium brick risk
This project hasn't been claimed by its maintainer yet, so its details come from the community. Is it yours? Claim it
ARM64 webOS adaptation of Chronomaly / CVE-2025-38352 (POSIX CPU timer UAF). Achieves persistent root from the unprivileged prisoner user on LG Smart TVs.
Verified Targets
| TV Model | Firmware Range | Kernel |
|---|---|---|
| LG OLED65C2PUA | 33.22.65 – 33.30.97 | 5.4.268-320 / -329 |
| LG 86QNED70AUA | 33.22.65 – 33.30.97 | 5.4.268-320 / -329 |
| LG OLED77C5PUA | 33.22.65 – 33.30.97 | 5.4.268-320 / -329 |
| LG OLED77G4WUA | 33.22.65 – 33.30.97 | 5.4.268-320 / -329 |
What's Included
exploit-arm64— pre-built static ARM64 binary (ready to deploy)getroot.c— full exploit sourcedeploy-webos.sh— build + deploy scriptMakefile— cross-compilation support
Quick Start
ssh -i ~/.ssh/webos_rsa -p 9922 prisoner@<TV_IP>
/tmp/exploit-arm64 [DELAY] [DELTA] [THRESHOLD]
See the README for prerequisites, tuning, and known-good values per model.
Disclaimer
This tool is for authorized security research and personal device ownership only. See the full Disclaimer before use. This vulnerability was responsibly disclosed to LG in February 2026.
Before you start
- How hard is it?
- HardUses the command line or developer tools.
- What you need
- Comfort with the command line
- A computer
- Can it break my device?
- Small chance of trouble, with a way to recover. It may void your warranty.
- Can I undo it?
- The project doesn't say. Assume you can't.
Did it work for you?
Did Chronomaly — CVE-2025-38352 on LG webOS v1.0.0 work on your LG OLED C3?
No reports yet for v1.0.0.
One-tap reports from owners. Bricked reports are checked before they count.
Compatibility
Devices: LG OLED C3.
No compatibility information yet.
Getting started
From the project's README ("Quick Start"):
Prerequisites
- LG webOS TV with kernel 5.4.268 (ARM64)
- Dev Mode enabled on the TV (SSH access on port 9922)
- ARM64 cross-compiler (aarch64-linux-gnu-gcc)
- Homebrew Channel IPK — download from webosbrew releases
Install Cross-Compiler
macOS (requires third-party tap) brew tap messense/macos-cross-toolchains brew install aarch64-unknown-linux-gnu
Ubuntu/Debian sudo apt-get install gcc-aarch64-linux-gnu
Recommended: Install Homebrew Channel First
Install the Homebrew Channel app on your TV via Dev Mode before running the exploit. This way the rooting payload only needs to elevate it (fast, reliable) rather than install + elevate (slower, can fail). You can sideload it using ares-install or the Dev Manager app:
ares-install org.webosbrew.hbchannel0.7.3all.ipk
If HBC is not pre-installed, the exploit will attempt to install it from /tmp/hbchannel.ipk (deployed by deploy-webos.sh), but this adds extra steps that can fail.
Build, Deploy, Run
Set your TV's IP and SSH key Your TV's IP is in Settings > Network > Wi-Fi > Advanced Settings The SSH key is generated by the LG Developer Mode app — look for the key downloaded by Dev Manager or ares-setup-device (typically named webosrsa) export WEBOSIP="<TVIP>" export WEBOSKEY="$HOME/.ssh/webosrsa"
Build and deploy (deploy-webos.sh handles the build automatically) ./deploy-webos.sh
Connect and run …
Risk and recovery
- Brick risk
- Medium
- Voids the warranty
- Yes
- Requires opening the device
- No
Releases
| Version | Name | Released |
|---|---|---|
| v1.0.0 | v1.0.0 — ARM64 webOS ExploitLatest | 30 May 2026 |