Unitree G1 Robot Vulnerability: Critical Risks

The report describes the UniBLEed disclosure of two chained vulnerabilities in the Unitree G1 humanoid robot (CVE-2026-76639 and CVE-2026-76640) that researchers reproduced on multiple units and which could allow an attacker within Bluetooth range to achieve root-level code execution by combining BLE, cloud API, Wi‑Fi provisioning, and Linux service flaws; the document outlines technical details, potential physical/privacy/business impacts, mitigation steps (firmware updates, network segmentation, Bluetooth exposure reduction), and notes vendor response and available fixes.