Executive brief
A logic error in the Telephony component of Google Pixel devices allows remote code execution without requiring user interaction or additional privileges. An attacker can exploit this vulnerability to gain code execution on the device, potentially compromising all data and functionality.
Technical details
CVE-2026-56882 is a remote code execution vulnerability in the Telephony subsystem of Google Pixel devices, stemming from a logic error in the code. The vulnerability is remotely exploitable over the network with no additional execution privileges required and no user interaction needed. An attacker can achieve remote code execution on affected Pixel devices. The vulnerability is addressed in the 2026-09-05 security patch level and later.
Affected products
- Google Pixel All supported Pixel devices prior to 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched