Executive brief
Google Pixel devices contain a security flaw in KeyMint, a component responsible for managing cryptographic keys. A local attacker could exploit a logic error to bypass security permissions and access sensitive information without needing special privileges or user interaction. This could lead to the unauthorized disclosure of private data stored on the device.
Technical details
A logic error in the KeyMint component of Google Pixel devices allows for a permission bypass. KeyMint is the hardware-backed Trusted Execution Environment (TEE) implementation for Keymaster/KeyStore. The vulnerability enables a local attacker to perform unauthorized information disclosure without requiring additional execution privileges or user interaction. The flaw is addressed in the June 2026 Pixel Update Bulletin with security patch levels of 2026-06-05 or later. While the NVD entry lists severity as 'info', the primary vendor source (Google) classifies this specific ID (Information Disclosure) vulnerability as 'High' (Élevée).
Affected products
- Google Pixel Android security patch level before 2026-06-05
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory
- 2026-06-05: patched