Factory Reset Protection (FRP) is a critical anti-theft mechanism mandated by Google on Android devices. However, legacy or budget devices—such as the Huawei Honor Play 3 (launched 2019, EMUI 9.1/10, no Google services after trade ban)—often retain residual FRP implementation flaws. This paper documents a reproducible bypass method using a combination of accessibility exploits, TalkBack activation, and a specially crafted intent from a hidden settings menu. The method requires no external tools beyond a Wi-Fi connection and a secondary device with a QR code generator. Results show successful bypass on firmware versions 9.1.0.260 to 10.0.0.183, with a 92% success rate (n=50). Mitigations and forensic implications are discussed.
A. R. SecRes & M. T. Mobile Forensics
Vulnerability Analysis and Bypass Methodologies for Factory Reset Protection (FRP) on the Honor Play 3 (Model: Ask-AL00x)
Factory Reset Protection (FRP) is a critical anti-theft mechanism mandated by Google on Android devices. However, legacy or budget devices—such as the Huawei Honor Play 3 (launched 2019, EMUI 9.1/10, no Google services after trade ban)—often retain residual FRP implementation flaws. This paper documents a reproducible bypass method using a combination of accessibility exploits, TalkBack activation, and a specially crafted intent from a hidden settings menu. The method requires no external tools beyond a Wi-Fi connection and a secondary device with a QR code generator. Results show successful bypass on firmware versions 9.1.0.260 to 10.0.0.183, with a 92% success rate (n=50). Mitigations and forensic implications are discussed.
A. R. SecRes & M. T. Mobile Forensics
Vulnerability Analysis and Bypass Methodologies for Factory Reset Protection (FRP) on the Honor Play 3 (Model: Ask-AL00x) honor play 3 frp bypass
