Executive brief
A security subsystem in Google Pixel devices contains a missing bounds check in cryptographic AES-GCM operations that allows an attacker with system privileges to read sensitive data from device memory. This could expose encryption keys, authentication credentials, or other confidential information processed by the device's secure components.
Technical details
The vulnerability is an out-of-bounds read in the do_sss_aes_gcm_256_op function of crypto-aes.c in the Google Secure Server System (GSA) component. A missing bounds check on buffer operations allows an attacker with System execution privileges to read memory beyond allocated boundaries. The attack is local, requires no user interaction, and can disclose sensitive information maintained by the secure enclave or cryptographic subsystem. Patches are available in the 2026-09-05 Android security update for Pixel devices.
Affected products
- Google Pixel devices All supported Pixel devices running OS versions prior to 2026-09-05 security patch
Timeline
- 2026-09-15: disclosed: Published in Pixel Update Bulletin—September 2026
- 2026-09-05: patched: Fixed in security patch level 2026-09-05 or later for all supported Pixel devices