JScalated: From the browser to ADB on KaiOS 3.1

Sat, 20 Jun 2026 10:00:00 +1000

JScalated exploits a Mozilla web development feature left enabled by the authors of KaiOS. It allows custom JavaScript execution in the context of any currently displayed webpage. For most operating systems, this would not give the user a significant amount of extra control over their device, but KaiOS features a well-known Engmode API.

The Engmode API allows apps to talk to the underlying Android operating system. It has become more and more hardened throughout the history of KaiOS. However, a few vulnerabilities have been found in the KaiOS 3.1 Engmode manager making injection trivial. JScalated uses the improperly handled setPropertyLE command shown below:

KaiOS 3.1 on KaiOS.dev

JScalated: From the browser to ADB on KaiOS 3.1