Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock

A public exploit package now lets owners of Amazon’s third-generation Fire TV Cube gain persistent root access and unlock the bootloader on firmware PS7717 or older.

Released by XDA developer Pro-me3us, the project targets devices known as “gazelle”. It combines temporary root access with a separate bootloader flaw to enable deeper system changes.

According to the XDA development thread, the unlock installs Magisk and TWRP recovery, opens restricted boot options, and supports alternative operating systems.

However, the developer warns that the process can permanently damage the device. It also performs an automatic factory reset and requires 1.5GB of user storage to maintain the unlock.

The process starts through Android Debug Bridge, or ADB, with debugging enabled and a connection authorized on the Cube. A temporary root tool gives the unlock script the permissions it needs. The device then restarts into TWRP to complete the changes before returning to FireOS for setup.

Amazon Fire TV Cube 3 Exploit

The project credits mforce2 with porting the Ghostlock exploit, associated with CVE-2026-43499, and NebuSec with developing the original exploit chain. John Red is credited with finding the bootloader vulnerability, while Pro-me3us brought the components together.

The thread also credits researcher Man Yue Mo’s earlier Mali GPU work involving CVE-2022-38181 and CVE-2022-46395 as a basis for testing and information gathering. These are separate contributions, not evidence that every listed flaw runs during each unlock.

Cybersecurity News previously covered how vulnerabilities in the Mali GPU driver can enable device takeover. That reporting explains the broader risk of low-level driver bugs, though it concerns different vulnerabilities than those credited here.

Once unlocked, the Cube gains Magisk support, TWRP backup and recovery features, unrestricted fastboot, and Amlogic download mode. Owners can also access the U-Boot command line over Ethernet and boot from USB storage.

The changes allow custom launchers, modified system and vendor partitions, and custom kernels or ROMs. Related projects include CoreELEC for Kodi-based media playback and EmuELEC for retro gaming. These features turn the streaming device into a more flexible platform for testing and personal use.

Version 1.2, dated September 30, 2026, extends the temporary root tool to PS7717/5741, updates Magisk to version 30.7, and includes a local ADB fix. It also clears the misc partition during unlocking to address firmware updates downloaded before the process begins.

The published method requires enabled, authorized ADB access. It is not presented as an unauthenticated remote attack, and the supplied thread does not report malicious exploitation in the wild.

The developer warns users never to modify the logo partition, which maintains the unlock, or rerun the bootloader unlock script. Running the temporary root tool twice within one boot can also crash and restart the Cube.

The package turns off automatic firmware updates, creating a security tradeoff for owners who keep the unlock. Related Samsung boot-chain research shows why control below Android can have lasting security effects, though those flaws are unrelated.

For everyday users, preserving normal updates remains the safer choice. Researchers should back up data, confirm the exact model and firmware, and weigh the risk of permanent damage before proceeding.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Amazon Fire TV Cube 3 Exploit Enables Root Access and Bootloader Unlock appeared first on Cyber Security News.