Executive brief
Google Pixel devices include a hardware security coprocessor (GSA) that handles image authentication for firmware integrity. A logic error in the authentication code allows a local attacker with system privileges to escalate privileges on the device. This could enable an attacker to gain complete control of the device and access all user data.
Technical details
A logic error exists in the gsa_sw_pk_hash_compare function within image-auth-srv.c of the GSA (Google Security Coprocessor) subsystem. The vulnerability permits local privilege escalation and requires System execution privileges to exploit. The attack vector is local, with no user interaction required. An attacker with system-level access can leverage this logic error to escalate privileges on affected Pixel devices. The vulnerability was addressed in Pixel devices receiving the 2026-09-05 security patch level.
Affected products
- Google Pixel <2026-09-05
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched