Executive brief
A critical security vulnerability exists in the wireless communication radio component of Google Pixel devices. This flaw allows a remote attacker to execute unauthorized code on the device without any user interaction or special access permissions. If exploited, an attacker could potentially take control of the device's communication functions or access sensitive data.
Technical details
An out-of-bounds write vulnerability exists in the WC-Radio (Wireless Communication Radio) component of Google Pixel devices due to a missing bounds check. The flaw allows for remote code execution (RCE) over the network without requiring additional execution privileges or user interaction. This is classified as a critical severity issue by Google. The vulnerability is addressed in the June 2026 Pixel Security Bulletin; devices with a security patch level of 2026-06-05 or later are protected.
Affected products
- Google Pixel Devices updated prior to June 2026 patch level
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory: Published in the June 2026 Pixel Update Bulletin
- 2026-06-05: patched: Security patch level date for fix