Executive brief
A logic error in the Bootloader component of Google Pixel devices allows a local attacker with system-level execution privileges to escalate their permissions further. The vulnerability exists in the address remapping functionality and requires no user interaction to exploit, potentially allowing an attacker to gain complete control of the device.
Technical details
This is a privilege escalation vulnerability (EoP) in the Bootloader's remap.c file, specifically in the addr_remap_address_map function. The root cause is a logic error in the code that fails to properly validate or enforce privilege boundaries during address remapping operations. The vulnerability requires the attacker to already have System execution privileges. Since this affects the Bootloader component, successful exploitation could allow circumvention of security mechanisms and permanent device compromise. Google released patches in the 2026-09-05 security update.
Affected products
- Google Pixel Bootloader September 2026 patch level prior to 2026-09-05
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched