Executive brief
A firmware component in Google Pixel devices contains an out-of-bounds memory write flaw in code that maps memory regions during boot. An attacker with local system-level access can exploit this to escalate privileges and gain complete control of the device, potentially leading to unauthorized access to all device data and functions.
Technical details
The vulnerability is an out-of-bounds write in multiple functions of remap.c due to an incorrect bounds check in the Bootloader component. The flaw allows an attacker with System execution privileges to write beyond allocated memory boundaries, leading to privilege escalation. This is a local vulnerability requiring system-level access; it does not require user interaction. Google patched this issue in the Pixel security update with patch level 2026-09-05 or later.
Affected products
- Google Pixel Bootloader pre-2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched