Security researchers exposed a chain of flaws in LG webOS that could give a local-network attacker root access to certain TVs without user interaction; LG pushed a firmware fix after the advisory.
A chain of vulnerabilities in LG’s webOS could allow a local-network attacker to gain root access on some LG smart TVs without any user interaction. LG has released a firmware fix after researchers disclosed the flaw on Oct 12, 2026.
The attack starts with a port-exposed pairing service, bypassing a PIN prompt and giving the attacker a privileged key. With root access via the internal tools, commands can run at the highest level.
Two models were tested on the latest webOS builds. If you own one of these TVs, update your firmware as soon as possible. If you can’t update yet, minimize network exposure and separate IoT devices from the main network.
Read in: English Français Deutsch Español
A security advisory outlines a chain of vulnerabilities in LG’s webOS that could let someone on the same local network gain root access to certain LG smart TVs without any action from the owner. LG says a firmware update fixes the issue after researchers published the details on Oct 12, 2026.
The exploit begins with a TV service exposed for pairing, typically used by the mobile app that connects to the TV. An attacker can replay a benign, built-in app manifest signed with a test certificate. A specific permission in that manifest lets the pairing service skip the screen PIN and hand over a privileged key to the attacker.
Having that key, the attacker can launch another built-in app and direct it to a page they control. That page can reach an internal tool the TV uses to run system commands. Because that internal tool runs with high privileges, the commands end up executing with root access, effectively giving the attacker full control over the TV.
The researchers tested the chain on two LG webOS TVs, a couple of models that were on hand for the test, both running a newer webOS version and a specific firmware build. LG has not confirmed broader coverage beyond the tested devices, and no public vulnerability identifiers have been assigned yet. Past webOS flaws have surfaced in earlier years, but LG notes this chain takes a different route through the local network environment.
LG’s advisory also notes there’s no workaround for devices that can’t be updated right away. If you own one of the affected TVs, check for firmware updates and install them when available.
In plain terms, a person connected to your home network could potentially take control of your TV without you interacting with it. The chain relies on exploiting the pairing feature that many households use to link phones and TVs, so even guests could pose a risk if the network isn’t properly segmented.
The vulnerability was demonstrated on two LG webOS TVs. LG did not publicly outline additional models beyond those tested, and it’s not yet clear which other devices or firmware revisions might be affected.
First, update your TV’s firmware as soon as the update is available for your model. If you can’t update yet, try to keep the TV on a different, guest, or isolated network from other smart devices, until you can apply the patch. LG has not provided a workaround for the revealed chain.
For most households, the practical takeaway is straightforward: keep smart TVs and other internet-connected devices updated, and consider network segmentation so a compromised device can’t easily reach other gear. This is a reminder that the software on a TV is not just a nice-to-have; it’s a potential entry point for attackers on the same network.
LG has acknowledged the advisory and issued a patch, but details about additional affected models may emerge as researchers and LG follow up. If you want to stay informed, watch for official notices from LG and any future disclosures from the researchers who demonstrated the chain.
Is my TV at risk if I don’t use the pairing feature?
Yes, because the attack begins with a pairing service used for that feature. If the TV’s pairing service is reachable on your network, updating is important.
How can I tell if I’m affected?
If you own one of the tested models and haven’t updated, you should apply the firmware patch when it’s available for your device.
Should I unplug the TV?
No need to unplug, but keep firmware current and consider isolating IoT devices on a separate network while patching rolls out.
You're reading the quick version.
Read next
Norway Grindr data fine is record 92m kroner, Xandr can appeal
Norway’s regulator levies a record fine on Xandr for mishandling Grindr user data in ads, stressing explicit consent rules.
A pediatrician argues the real risk to youth is not AI, but how we talk about technology at home.
TFG says some IT systems were affected; customers may be contacted if their data is involved, while shopping in stores remains mostly normal.
A new look at public records shows how city contracts with Flock Safety can quietly grow over years, tying taxpayers to rising bills and new features.
The Daily Brief
Every morning, the news that matters from AI, phones, apps and the people shaping tech. Explained in plain English. Free.
One email a day. No spam, unsubscribe anytime. Privacy policy
