Executive brief
A critical security vulnerability exists in Google Pixel devices within the component responsible for multimedia messaging and calling services. An attacker could remotely execute malicious code on a user's device without any interaction from the user or special access permissions. This could lead to a total compromise of the device, including the theft of personal data or unauthorized access to device functions.
Technical details
A heap buffer overflow exists in the 'libpixelimsmedia' component of Google Pixel devices, specifically within the 'RtpSession::rtpSendRtcpPacket' function. The vulnerability is characterized as an out-of-bounds (OOB) write. It can be triggered remotely over a network without any prior authentication or user interaction. Successful exploitation allows an attacker to achieve remote code execution (RCE) with no additional privileges required. Google addressed this issue in the June 2026 Pixel Update Bulletin; users should ensure their security patch level is 2026-06-05 or later.
Affected products
- Google Pixel Prior to June 2026 update
Timeline
- 2026-06-16: disclosed
- 2026-06-16: advisory
- 2026-06-05: patched