Executive brief
Google Pixel devices use a VP9 video decoder component (BigOcean) to process video streams. A missing bounds check in the frame header parsing code allows an attacker to write beyond allocated memory, potentially enabling privilege escalation on affected devices without requiring user interaction.
Technical details
This vulnerability is a classic out-of-bounds write in the Vp9DecodeFrameTag function of vp9hwd_headers.cc, caused by insufficient validation of frame dimensions or related parameters before allocating or writing to internal buffers. An attacker can craft a malicious VP9 video file or stream that triggers the overflow when parsed, allowing arbitrary memory corruption. The attack vector is network-based (remote delivery of malicious video content) with no special privileges or user interaction required for exploitation. The vulnerability impacts the BigOcean module and enables escalation of privilege. Google patched this issue in the 2026-09-05 security patch level.
Affected products
- Google Pixel all Pixel devices before 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed: Published in Google Pixel Update Bulletin—September 2026
- 2026-09-05: patched: Addressed in 2026-09-05 security patch level