Executive brief
A logic error in the Bootloader's permission initialization code allows a local attacker to bypass security restrictions and escalate their privileges without needing special execution rights. This vulnerability could allow unauthorized access to sensitive device functions and system resources on affected Pixel devices.
Technical details
This is a privilege escalation (EoP) vulnerability in the ac_init_policy function within init.c of the Google Pixel Bootloader. The vulnerability stems from a logic error in the permission-checking code that fails to properly validate access control policies. An attacker with local access can exploit this flaw to bypass permission restrictions and gain elevated privileges. No additional execution privileges or user interaction are required for exploitation. The vulnerability affects Pixel devices, and patches are available in the 2026-09-05 security patch level.
Affected products
- Google Pixel Bootloader Prior to 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed