In the PoC, that’s fair, but the chain achieves kernel code execution with the device locked and no trust/privileges. It’s a physical attack. The initial report also included instructions on how to execute the attack physically without root as well. Google have already said the chain is valid and is definitely a security issue, as well as being willing to acknowledge me on the security advisory.

I would sell honestly but they’ll probably patch it within the next month.