hexo141/rootme

Rootme is a small collection of web pages that demonstrate a chained exploit against the Firefox browser on Android devices. According to the README, it uses a Firefox JIT type confusion vulnerability, tracked as CVE-2026-23274, to gain initial code execution, or a shell, on the device, and then chains that into a separate kernel vulnerability, CVE-2026-43499, to escalate privileges further on the system. The README is short and mostly consists of a warning. It states this project is for learning and research only, that it should only be run on a device you personally own, and that you should back up your data first, because the exploitation process can crash the device, force a restart, or cause data loss. The author states they are not responsible for any consequences from misuse of the project. There is also a link to a live deployed version of the site, hosted at a subdomain, presumably so the vulnerability can be tested or observed directly through a browser rather than by setting up the code locally. The repository itself does not include setup instructions, a license file, or any description of its internal code structure in the README, so beyond the two referenced CVEs and the live demo link, there is little else documented about how the project is built or how to run it yourself. Given the subject matter, this is squarely a security research and vulnerability demonstration project rather than a general purpose tool, and it should only be used in line with its own stated warning: on devices you own, for learning purposes, with an understanding that things can go wrong during testing.