Summary This report covers a fullchain built from sync-demo LG-signed manifest replay client-key issuance bypass, cmp-client interactiveUrl PalmServiceBridge SSRF, and pmlogd collectAllLog targetDir command injection. First, the attacker replays the LG-signed manifest embedded in com.webos.app.sync-demo. SSG trusts the signature and follows the STB_INTERNAL_CONNECTION prompt-skip path, issuing a SECURE-tier client-key without a PIN prompt. Then cmp-client … LG webOS sync-demo Preauth RCE Read More »