Executive brief
Fuchsia is Google's operating system that manages core system resources including memory paging. A use-after-free vulnerability in the zircon kernel's pager proxy allows unprivileged user applications to exploit freed memory and execute arbitrary code with kernel privileges. An attacker could gain complete system control, compromise all data on the device, and bypass all security protections.
Technical details
The vulnerability is a use-after-free condition in the zircon kernel pager proxy component, which manages virtual memory operations. An unprivileged user-space process can trigger code paths that access memory that has been freed, allowing memory corruption and arbitrary code execution. The attack requires no special privileges or authentication; it can be triggered directly from user-space. Successful exploitation results in privilege escalation from user-space context to kernel privilege level (AP). A patch is expected in the August 2026 security update.
Affected products
- Google Fuchsia <unknown; patched in 2026-08
Timeline
- 2026-08-24: disclosed
- 2026-08: patched: Fuchsia security update