Analysis of the exploit identified two different vulnerabilities in Chrome: After escaping the sandbox, the exploit downloaded another exploit in /data/data/com.android.chrome/p.so to elevate privileges and install the implant.