Executive brief
The bootloader in Google Pixel devices contains a missing permission check that allows an attacker with system-level access to escalate privileges. This vulnerability affects the firmware that initializes the device before the operating system loads, and successful exploitation could allow an attacker to gain complete control of the device and bypass security protections.
Technical details
This is a privilege escalation (EoP) vulnerability in the Pixel bootloader caused by a missing permission check, classified as a permission bypass. The vulnerability requires System execution privileges as a precondition and can be exploited locally without user interaction. An attacker with system-level access can bypass permission controls in the bootloader to escalate to higher privileges. The vulnerability was addressed in the September 2026 security patch (2026-09-05 or later) for all supported Pixel devices.
Affected products
- Google Pixel prior to 2026-09-05
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched