LG webOS Smart TVs: Three-Bug Chain Gives Root to Anyone on the Same Network

A newly disclosed chain of three flaws in LG's webOS lets an attacker who shares a local network with certain LG smart TVs take full root control of the device — no pairing PIN, no click, no involvement from the owner. LG has shipped a firmware fix, published in a coordinated disclosure advisory on October 12, 2026.

What happened

The chain was confirmed on two models — the 32LQ636BPSA and the 27TQ600SW — running webOS 7.5.7-25 on firmware 04.54.40. Whether other models or firmware builds are exposed has not been established, so owners of any LG webOS set should treat the update as relevant until LG says otherwise.

At a high level, the attack strings together three weaknesses:

1. Pairing bypass. The TV listens on TCP port 3001 for the LG ThinQ companion-app pairing service. By replaying a manifest from a built-in demo app — signed with a test certificate the firmware still trusts — an attacker gets the pairing service to skip the PIN prompt and hand over a privileged key.
2. Unrestricted in-app browsing. With that key, the attacker opens another preinstalled app and points it at a page they control. The app doesn't restrict where it navigates, and the loaded page keeps access to the TV's internal system-service bridge.
3. Command injection as root. Through that bridge, the attacker reaches the system logging service, which passes an unvalidated input field to the shell. Because the logger runs as root, so do the attacker's commands.

The chain was demonstrated by an anonymous researcher who placed third in the LG webOS category at TyphoonPWN 2026 in Seoul in May. No CVE identifiers have been assigned, and no exploitation in the wild has been reported.

This isn't the first time webOS has been reachable this way: a separate set of network-exploitable webOS flaws was patched in March 2024, and a different path-traversal chain on another port was shown at TyphoonPWN 2025.

Why it matters

A smart TV is a Linux computer with a microphone, sometimes a camera, saved streaming and account sessions, and a permanent seat on your network. Root on that device means an attacker can persist quietly, watch traffic, and use it as a foothold toward laptops, NAS boxes or — in an office — meeting-room systems and the corporate LAN.

The precondition is "same local network", which sounds reassuring until you count who shares that network: guests on home Wi-Fi, visitors on a flat office network, other tenants in hotels and co-working spaces, or any already-compromised device on the LAN. Smart TVs also tend to be the least-patched, least-monitored endpoint in the building.

What to do

• Update now. Check for and install the latest firmware on every LG webOS TV and monitor (Settings → General/Support → Software Update), and turn on automatic updates. There is no workaround for sets that can't be updated yet.
• Segment it. Put TVs, displays and other IoT on their own VLAN or guest/IoT SSID, isolated from workstations, servers and NAS devices. Block client-to-client traffic where you can.
• Restrict port 3001. If your network gear allows it, prevent untrusted segments from reaching TCP/3001 on TV devices; if you don't use ThinQ / mobile-app pairing, disable it in the TV settings.
• Inventory the "dumb" screens. Meeting rooms, reception displays and digital signage often run consumer webOS firmware. Find them, update them, and add them to your asset list.
• Watch for oddities. Unexpected outbound connections or new listening services from a TV's IP are worth investigating.

Consumer and office IoT is part of your attack surface whether or not it's on your asset register. If you'd like an outside view of what's exposed on your network and perimeter, the 4Tify team can help.