Executive brief
A security vulnerability exists in the LWIS component of Google Pixel devices. This flaw could allow a local attacker who already has high-level system privileges to gain even further control over the device's core functions. While it requires initial access, it could be used to bypass security boundaries and compromise the integrity of the operating system.
Technical details
An out-of-bounds write vulnerability exists in the 'lwis_io_buffer_write' function within 'lwis_io_buffer.c' of the LWIS (Lightweight Imaging Subsystem) component. The flaw is caused by memory corruption that can be triggered locally. An attacker with System execution privileges can exploit this to achieve further escalation of privilege. No user interaction is required for exploitation. The issue was addressed in the June 2026 Pixel Security Bulletin.
Affected products
- Google Pixel Devices updated before June 2026 patch level
Timeline
- 2026-06-16: disclosed: NVD publication date
- 2026-06-05: patched: Security patch level date for Pixel devices
- 2026-06-16: advisory: Google Pixel Update Bulletin published