Three vulnerabilities in LG's webOS can be chained so that an attacker on the same local network gets root on the TV, with no PIN and no action from the owner. SSD Secure Disclosure published the details on 12 October 2026, together with complete proof-of-concept code. LG has released a fix, listed in its security bulletin for TVs.
The chain was confirmed on two models, the 32LQ636BPSA and the 27TQ600SW, running webOS 7.5.7-25 with firmware 04.54.40. Whether other models or firmware versions are affected is not known. According to The Hacker News, no CVE numbers have been assigned and no exploitation in the wild has been reported.
How the chain works
The entry point is the service on port 3001 that the LG ThinQ app uses to pair with the TV. The firmware contains a built-in app, sync-demo, whose manifest is signed with a test certificate that the TV trusts. That manifest carries the STB_INTERNAL_CONNECTION permission, and when the pairing service sees it, it skips the PIN prompt. An attacker who replays the manifest receives a privileged client key, and nothing appears on the screen.
With that key the attacker launches another built-in app, cmp-client, and passes it a URL. The app only checks that the address answers a HEAD request and then navigates there, with no restriction on the scheme or the host. The attacker's page keeps access to PalmServiceBridge, the interface to the TV's internal system services, so it can call methods the pairing connection itself cannot reach.
The last link is the logging service, pmlogd. Its collectAllLog method pastes the targetDir field into shell commands without checking it. pmlogd runs as root, so the injected command runs as root as well.
The researcher, who remains anonymous, took third place in the LG webOS category at TyphoonPWN 2026, held in Seoul in May. The Hacker News points out that this is not the first network path to root on LG TVs: Bitdefender disclosed a different set of webOS flaws reachable from the network in 2024, patched in March of that year.
What to do
Install the latest firmware on the TV. The Hacker News notes there is no workaround for owners who cannot update yet. The exploit code is public and needs nothing more than network access to the TV, so a TV that cannot be updated is a good candidate for a separate network for smart home and entertainment devices. Bear in mind that the phone app and any Home Assistant integration that controls the TV will then need a firewall rule to reach it.