## https://sploitus.com/exploit?id=E6D9AB38-FE17-5067-90C6-81A3208AC542
# CVE-2026-43499-A36
Standalone, device-tested CVE-2026-43499 port for the Canadian Galaxy A36 5G
`SM-A366W` on exact firmware `A366WVLS3AYG1`, including KernelSU late-load and
Root My Galaxy integration.
This repository contains the device-specific native side of
[Root My Galaxy](https://github.com/BuSung-dev/Root-My-Galaxy):
- exact firmware profiles and offsets;
- the app-domain CVE-2026-43499 exploit source and compiled payload;
- the app bootstrap helper source;
- the verified KernelSU late-load build artifacts;
- the support feed consumed by the application.
It intentionally does not contain Android application source code.
## Supported profiles
| Profile | Device | Firmware | Kernel/KMI | Status |
| --- | --- | --- | --- | --- |
| `pa3q-S938NKSUACZF1` | Galaxy S25 Ultra `SM-S938N` | `BP4A.251205.006.S938NKSUACZF1` | `android15-6.6` | Device-tested |
| `pa3q-S9380ZHUBCZF1` | Galaxy S25 Ultra `SM-S9380` | `BP4A.251205.006.S9380ZHUBCZF1` | `android15-6.6` | Device-tested |
| `e3q-S928USQS6DZF2` | Galaxy S24 Ultra `SM-S928U/SM-S928U1` (Snapdragon 8 Gen 3) | `BP4A.251205.006.S928USQS6DZF2` | `6.1.145-android14-11-33419968-abS928USQS6DZF2` | Hardware debugging in progress |
| `essi-A566EXXSCCZG6` | Galaxy A56 5G `SM-A566E` | `BP4A.251205.006.A566EXXSCCZG6` | `6.6.102-android15-8-abA566EXXSCCZG6-4k` | Device-tested |
| `a36xq-A366WVLS3AYG1` | Galaxy A36 5G `SM-A366W` | `AP3A.240905.015.A2.A366WVLS3AYG1` | `6.6.46-android15-8-30526735-abogkiA366WVLS3AYG1-4k` | Device-tested |
Profiles are exact-firmware profiles. A matching model with a different build
is not equivalent and must be ported separately.
Root My Galaxy requires both the exact `uname -r` value in `kernelRelease` and
the complete `/proc/version` value in `kernelVersion`. This distinguishes
vendor kernels that expose the same release string but were linked from
different builds. Model and device fields are descriptive metadata; build
display ID, SDK, ABI, and page size remain part of automatic profile selection.
The port is based on the exploit source published at
.
## Feed delivery
Root My Galaxy resolves the payload repository's current commit first and
fetches `support/targets-v2.json` and every artifact from that immutable commit.
Per-artifact SHA-256 fields and manifest signatures are not part of schema
version 2.
## Build
```sh
make TARGET=pa3q-S938NKSUACZF1 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=e3q-S928USQS6DZF2 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=essi-S721NKSSCDZF3 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=e1s-S921BXXSFDZF2 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=a15-A155NKSS6BYH1 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=essi-A566EXXSCCZG6 ANDROID_NDK_HOME=/path/to/android-ndk
make TARGET=a36xq-A366WVLS3AYG1 ANDROID_NDK_HOME=/path/to/android-ndk
```
Outputs:
```text
build//cve-2026-43499
build//cve-2026-43499-app.so
build//cve-2026-43499-root
```
The release app payload is built with:
```sh
make TARGET=essi-S721NKSSCDZF3 ANDROID_NDK_HOME=/path/to/android-ndk release
```
The complete firmware-to-profile procedure is recorded in
[`docs/PORTING.md`](docs/PORTING.md). Samsung-specific KernelSU changes and
versioned artifacts are documented in [`kernelsu/README.md`](kernelsu/README.md).
The exact S921B DZF2 analysis is recorded separately in
[`docs/SM-S921B-S921BXXSFDZF2.md`](docs/SM-S921B-S921BXXSFDZF2.md), and the
S928U/S928U1 DZF2 analysis is in
[`docs/SM-S928U1-S928U1UES6DZF2.md`](docs/SM-S928U1-S928U1UES6DZF2.md). S921B
is an Exynos 2400 target and is not a Qualcomm/Snapdragon reference for E3Q.
The 5.10 A15 analysis is in
[`docs/SM-A155N-A155NKSS6BYH1.md`](docs/SM-A155N-A155NKSS6BYH1.md).
The SM-A566E CCZG6 analysis and validation record is in
[`docs/SM-A566E-A566EXXSCCZG6.md`](docs/SM-A566E-A566EXXSCCZG6.md).
The complete SM-A366W AYG1 device-success record is in
[`docs/SM-A366W-A366WVLS3AYG1-SUCCESS.md`](docs/SM-A366W-A366WVLS3AYG1-SUCCESS.md).
Use only on devices you own or are explicitly authorized to test.