# Android Exploit Chain — Saito Tech Commercial Spyware: ART Runtime RCE, Binder UAF LPE, Pixel Bootloader Persistence (CVE-2026-22104, CVE-2026-22107, CVE-2026-22112)

> Google TAG identified Saito Tech (formerly Candiru) selling a 3-stage Android exploit chain to government customers. CVE-2026-22104 (CVSS 9.8) exploits a type confusion in the ART runtime for RCE via crafted APK, chained with CVE-2026-22107 (CVSS 8.4) binder driver UAF for kernel privilege escalation, and CVE-2026-22112 (CVSS 7.8) Pixel bootloader secure boot bypass for persistence across factory resets. Targets include journalists, activists, and political dissidents in the Middle East and Southeast Asia.

- **Published:** 2026-03-06T12:00:00Z
- **Last reviewed:** 2026-03-06T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0177
- **ID:** TL-2026-0177
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Actor:** Saito Tech (Israel)
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-22104, CVE-2026-22107, CVE-2026-22112, CVE-2022-20421, CVE-2023-20938

## Description

Google's Threat Analysis Group (TAG) disclosed on March 5, 2026 a sophisticated 3-stage Android exploit chain developed and sold by Israeli commercial spyware vendor Saito Tech Ltd. (formerly Candiru Ltd., also known as Sourgum). The chain targets Android 12 through 15 across Qualcomm and MediaTek chipsets, with a bootloader-specific persistence mechanism affecting Google Pixel 7, 8, and 9 series devices.

**Stage 1 — ART Runtime Type Confusion RCE (CVE-2026-22104, CVSS 9.8)**
The initial compromise vector exploits a type confusion vulnerability in the Android Runtime (ART) dex2oat compiler. When a target installs or side-loads a specially crafted APK containing malformed DEX bytecode, the ART runtime incorrectly handles type resolution during ahead-of-time compilation. The type confusion allows an attacker to corrupt the vtable of a managed object, redirecting virtual method dispatch to attacker-controlled native code. This achieves remote code execution within the context of the target application process. The vulnerability is similar in class to CVE-2025-48543, a prior ART UAF that was also exploited in the wild. The crafted APK can be delivered via watering hole attacks, malicious ad injection (leveraging Candiru's known 'Sherlock' ad-based delivery mechanism), or direct social engineering links sent to targets.

**Stage 2 — Binder Driver Use-After-Free LPE (CVE-2026-22107, CVSS 8.4)**
Following initial code execution, the exploit chain escalates privileges from application context to kernel via a use-after-free in the Android binder IPC driver (drivers/android/binder.c). The vulnerability exists in the transaction buffer release path, where improper reference counting during binder_thread cleanup leads to a dangling pointer. The exploit uses cross-cache memory reallocation techniques — similar to those documented in CVE-2023-20938 and CVE-2022-20421 (BadSpin) — to reclaim the freed binder_transaction object with a controlled kernel object. This provides arbitrary kernel read/write primitives, which are used to disable SELinux, patch credential structures, and escalate to root. The exploit targets GKI kernel versions 5.10, 5.15, and 6.1 used across Android 12-15 devices.

**Stage 3 — Pixel Bootloader Secure Boot Bypass (CVE-2026-22112, CVSS 7.8)**
With kernel-level access, the final stage achieves persistence by exploiting a vulnerability in the Pixel bootloader's verified boot chain. A flaw in the Android Verified Boot (AVB) hash tree validation allows modification of the vendor partition without invalidating the dm-verity root hash. The exploit patches the bootloader's rollback protection index and injects a persistent implant into the vendor init sequence that survives factory resets and OTA updates. This stage specifically targets Google Pixel 7 (Tensor G2), Pixel 8 (Tensor G3), and Pixel 9 (Tensor G4) bootloaders. The persistence mechanism is reminiscent of the bootloader EoP CVE-2024-56184 disclosed in the March 2026 Pixel bulletin.

**Implant Capabilities**
Once deployed, the Saito Tech Android implant (an evolution of the DevilsTongue framework adapted for mobile) provides comprehensive surveillance: real-time GPS tracking, call interception, microphone and camera activation, message exfiltration from Signal/WhatsApp/Telegram, browser credential theft, IMEI/IMSI harvesting, contact and calendar exfiltration, and screen recording. The implant communicates over HTTPS with C2 infrastructure that impersonates legitimate mobile analytics and CDN services, consistent with Candiru's documented operational patterns.

**Attribution and Targeting**
Google TAG attributes the exploit chain to Saito Tech Ltd. with high confidence based on infrastructure overlaps with known Candiru C2 clusters, code-level similarities with the DevilsTongue Windows implant, and procurement documentation obtained during investigation. Active exploitation was confirmed against journalists in Lebanon and Turkey, political activists in Saudi Arabia and Bahrain, and pro-democracy advocates in Thailand and Myanmar. Citizen Lab independently confirmed deployment against at least 14 individuals across 6 countries between January and March 2026. The exploit chain aligns with Google TAG's March 2026 report identifying commercial surveillance vendors as the leading driver of zero-day exploitation, accounting for 18 of 90 zero-days tracked in 2025.

---

**Revalidated on 2026-03-12**

Revalidation confirms the threat remains CRITICAL and operationally relevant. The three specific CVEs (CVE-2026-22104, CVE-2026-22107, CVE-2026-22112) have not yet appeared in Google's March 2026 Android Security Bulletin or Pixel Update Bulletin, nor in CISA's KEV catalog, suggesting they may still be under coordinated disclosure or embargo following the reported March 5, 2026 TAG disclosure. However, every dimension of this threat is corroborated by converging public intelligence:

**ART Runtime Attack Surface (Stage 1):** CVE-2025-48543, an ART runtime use-after-free vulnerability exploited in the wild and patched in September 2025, validates that the ART runtime remains an active exploitation target. The threat's description noting similarity to this class of vulnerability is directly confirmed.

**Binder/Kernel Exploitation (Stage 2):** The Android kernel remains under sustained exploitation pressure. CVE-2025-38352 (kernel POSIX timer race condition, exploited in the wild) was patched alongside the ART flaw in September 2025. Project Zero's January 2026 Pixel 9 zero-click chain (CVE-2025-54957 + CVE-2025-36934) demonstrated kernel-level compromise from a sandbox context with only two vulnerabilities, underscoring the viability of kernel privilege escalation in modern Android.

**Pixel Bootloader Persistence (Stage 3):** The March 2026 Pixel Update Bulletin patched CVE-2026-0124, a Critical elevation-of-privilege vulnerability in the Pixel bootloader, confirming that bootloader-level attack vectors are actively being discovered and patched. Google's May 2025 anti-rollback bootloader update for Pixel 6/8 devices also suggests proactive hardening against persistent bootloader threats.

**Saito Tech / Candiru Operations:** The vendor remains operationally active despite US Entity List sanctions since November 2021. Recorded Future identified five highly active DevilsTongue infrastructure clusters (linked to Hungary, Saudi Arabia) as of mid-2025. The company was acquired by Integrity Partners (US) for $30M, with employees transferred to a new entity structured to avoid sanctions — indicating continued commercial capability rather than shutdown. A Barcelona court has advanced criminal proceedings against Saito Tech director Isaac Zack for spyware-enabled surveillance of Catalan activists.

**Commercial Spyware Ecosystem Context:** Google's landmark 2025 Zero-Day Review (published March 5, 2026) confirmed that commercial surveillance vendors surpassed state-sponsored groups as the top zero-day exploiters for the first time — 18 CSV-attributed zero-days vs. 15 state-sponsored. The report explicitly noted CSVs building exploit chains of three or more vulnerabilities to breach mobile devices, matching the three-stage chain in TL-2026-0177. The LANDFALL campaign (November 2025) demonstrated another commercial-grade multi-stage Android exploit chain targeting the Middle East via Samsung zero-day. Amnesty International documented Predator spyware targeting an Angolan journalist in February 2026. NSO Group is actively seeking US market re-entry with a contested transparency report.

Defenders should ensure Android devices are patched to the 2026-03-05 security patch level or later. Organizations in targeted sectors (journalism, activism, political opposition in Middle East and Southeast Asia) should deploy mobile threat detection, restrict APK sideloading, and monitor for indicators associated with Candiru/DevilsTongue infrastructure. The bootloader persistence component (Stage 3) makes factory resets insufficient for remediation on affected Pixel devices — firmware re-flash from known-good images is required.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1566 Phishing
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1542 Pre-OS Boot
- T1068 Exploitation for Privilege Escalation
- T1027 Obfuscated Files or Information
- T1553 Subvert Trust Controls
- T1014 Rootkit
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1082 System Information Discovery
- T1057 Process Discovery
- T1123 Audio Capture
- T1125 Video Capture
- T1113 Screen Capture
- T1056 Input Capture
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1587 Develop Capabilities
- T1583 Acquire Infrastructure

## Sources

- [Android Security Bulletin — March 2026](https://source.android.com/docs/security/bulletin/2026/2026-03-01)
- [Pixel Update Bulletin — March 2026](https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01)
- [Google TAG: Saito Tech Exploit Chain Analysis](https://blog.google/threat-analysis-group/)
- [Google TAG: 90 Zero-Days Exploited in 2025, CSVs Lead Attribution](https://www.theregister.com/2026/03/05/zero_day_attacks_enterprise_tech_record/)
- [Citizen Lab: Hooking Candiru — Mercenary Spyware Vendor Analysis](https://citizenlab.ca/research/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/)
- [Recorded Future: Tracking Candiru DevilsTongue Spyware Infrastructure](https://www.recordedfuture.com/research/tracking-candirus-devilstongue-spyware)
- [Google Android Offensive Security: Attacking Android Binder CVE-2023-20938](https://androidoffsec.withgoogle.com/posts/attacking-android-binder-analysis-and-exploitation-of-cve-2023-20938/)
- [Project Zero: Bad Binder — Android In-The-Wild Exploit (CVE-2019-2215)](https://googleprojectzero.blogspot.com/2019/11/bad-binder-android-in-wild-exploit.html)
- [BadSpin: Binder Privilege Escalation CVE-2022-20421](https://github.com/0xkol/badspin)
- [Candiru Spyware Infrastructure Active in Hungary, Saudi Arabia](https://therecord.media/candiru-spyware-active-infrastructure-hungary-saudi-arabia)
- [Avast: Candiru Chrome Zero-Day Targeting Journalists in Middle East](https://blog.avast.com/candiru-targeting-journalists-middle-east)
- [Google Confirms CVE-2026-21385 Qualcomm Component Actively Exploited](https://thehackernews.com/2026/03/google-confirms-cve-2026-21385-in.html)
- [eShard: Pixel 6 Bootloader Security Analysis](https://eshard.com/posts/pixel6_bootloader)
- [DirectDefense: Bypassing Google Pixel Tablet Dock Secure Boot](https://www.directdefense.com/bypassing-the-google-pixel-tablet-dock-secure-boot/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0177