A public exploit package has dropped for the third-generation Amazon Fire TV Cube (codename "gazelle"), giving owners persistent root access and bootloader unlock on firmware PS7717 and older. It was released by XDA developer Pro-me3us.
How it works: The project chains a temporary root tool together with a separate bootloader vulnerability. Once unlocked, you get Magisk, TWRP recovery, unrestricted fastboot, Amlogic download mode, and U-Boot command line access over Ethernet. It also supports booting from USB storage, custom launchers, modified system/vendor partitions, and custom kernels or ROMs — including CoreELEC and EmuELEC for anyone wanting to turn the Cube into a media/retro gaming box.
Heads up before you try it:
The process can permanently brick the device
It triggers an automatic factory reset
You need 1.5GB of free storage to maintain the unlock
Requires ADB debugging enabled and an authorized connection
Do not touch the logo partition (it maintains the unlock)
Do not rerun the bootloader unlock script
Running the temporary root tool twice in one boot can crash/reboot the Cube
Credits: mforce2 (porting the Ghostlock exploit, CVE-2026-43499), NebuSec (original exploit chain), John Red (bootloader vuln), and Pro-me3us for putting it all together. Man Yue Mo's earlier Mali GPU work (CVE-2022-38181, CVE-2022-46395) is also credited as a basis for testing — though those are separate contributions, not part of every unlock.
Version 1.2 (Sept 30, 2026) extends the temporary root tool to PS7717/5741, bumps Magisk to 30.7, adds a local ADB fix, and clears the misc partition during unlocking to handle pre-downloaded firmware updates.
Important caveat: This isn't an unauthenticated remote attack — it requires enabled, authorized ADB access. No malicious exploitation in the wild has been reported. Note that the unlock disables automatic firmware updates, which is a real security tradeoff. For most everyday users, sticking with normal updates is still the safer call.
Source: Cyber Security News — Abinaya, 2026-10-13
How it works: The project chains a temporary root tool together with a separate bootloader vulnerability. Once unlocked, you get Magisk, TWRP recovery, unrestricted fastboot, Amlogic download mode, and U-Boot command line access over Ethernet. It also supports booting from USB storage, custom launchers, modified system/vendor partitions, and custom kernels or ROMs — including CoreELEC and EmuELEC for anyone wanting to turn the Cube into a media/retro gaming box.
Heads up before you try it:
The process can permanently brick the device
It triggers an automatic factory reset
You need 1.5GB of free storage to maintain the unlock
Requires ADB debugging enabled and an authorized connection
Do not touch the logo partition (it maintains the unlock)
Do not rerun the bootloader unlock script
Running the temporary root tool twice in one boot can crash/reboot the Cube
Credits: mforce2 (porting the Ghostlock exploit, CVE-2026-43499), NebuSec (original exploit chain), John Red (bootloader vuln), and Pro-me3us for putting it all together. Man Yue Mo's earlier Mali GPU work (CVE-2022-38181, CVE-2022-46395) is also credited as a basis for testing — though those are separate contributions, not part of every unlock.
Version 1.2 (Sept 30, 2026) extends the temporary root tool to PS7717/5741, bumps Magisk to 30.7, adds a local ADB fix, and clears the misc partition during unlocking to handle pre-downloaded firmware updates.
Important caveat: This isn't an unauthenticated remote attack — it requires enabled, authorized ADB access. No malicious exploitation in the wild has been reported. Note that the unlock disables automatic firmware updates, which is a real security tradeoff. For most everyday users, sticking with normal updates is still the safer call.
Source: Cyber Security News — Abinaya, 2026-10-13
THE WORDS OF A WISE ONE
