SlopBro
SlopBro is a proof-of-concept exploit for the jsserver vulnerability in LG TVs.
- Root exploit
- Alpha
- Low brick risk
This project hasn't been claimed by its maintainer yet, so its details come from the community. Is it yours? Claim it
Before you start
- How hard is it?
- HardUses the command line or developer tools.
- What you need
- Comfort with the command line
- A computer
- Can it break my device?
- Very unlikely to break anything.
- Can I undo it?
- The project doesn't say. Assume you can't.
Did it work for you?
Did SlopBro v0.0.5 work on your LG OLED C3?
No reports yet for v0.0.5.
One-tap reports from owners. Bricked reports are checked before they count.
Compatibility
Devices: LG OLED C3.
No compatibility information yet.
Getting started
From the project's README ("Running"):
Run the script with Python 3, passing the IP address of your TV:
python slopbro.py [--debug] [--curl-insecure] [--fake-service-path <PATH>|--no-fake-service-path] [--local-ip <LOCAL IP>] [--webos-version <VERSION>] [--asset-source <auto|dir|embedded>] [--test-server <simple|payload>] [<TV IP ADDRESS>]
Use python3 slopbro.py --help for the full option reference.
Accept the pairing prompt on the target TV. (The credentials will be saved in a .key file for future use.)
Options
The --debug option enables extra output on the TV screen as well as in autoroot.log.
The --curl-insecure option passes -k to curl when downloading Homebrew Channel, disabling TLS certificate verification. Use it only when necessary (e.g., when your TV does not have the correct date due to SDP being blocked).
The --fake-service-path option specifies the fake service path used to bypass the service launch patch. It defaults to /usr/palm/services/com.palm.service.devmode. Use --no-fake-service-path to disable the bypass and omit the fake-service-path query parameter.
The --local-ip option allows you to specify the local IP address manually, which can be useful if the script guesses the wrong IP address.
The --webos-version option specifies the TV's webOS version and limits the target apps to those configured for that major version. Dotted versions such as 6.5 are accepted and treated as major version 6.
The version is not currently auto-detected, so you may need to specify it if …
Risk and recovery
- Brick risk
- Low
- Requires opening the device
- No
Releases
| Version | Name | Released |
|---|---|---|
| v0.1.0 | Release 0.1.0Pre-release | 28 September 2026 |
| v0.0.5 | Release 0.0.5Latest | 27 July 2026 |
| v0.0.4 | Release 0.0.4 | 4 July 2026 |
| v0.0.3 | Release 0.0.3Pre-release | 4 July 2026 |
| v0.0.2 | Release 0.0.2 | 21 June 2026 |
| v0.0.1 | Release 0.0.1 | 19 June 2026 |
Credits, license and support
- License
- AGPL-3.0