Executive brief
A permission bypass vulnerability in the Google Security Architecture (GSA) component affects Google Pixel devices and can be exploited locally to escalate privileges without needing special execution rights or user interaction. An attacker with local access to a device could gain elevated permissions, potentially accessing sensitive device features or data that are normally restricted to authorized applications.
Technical details
The vulnerability is a permission bypass caused by side channel information disclosure in the Google Security Architecture (GSA) component used in Google Pixel devices. The flaw allows a local attacker to infer sensitive information through side channels (such as timing or resource usage patterns) and bypass permission checks, leading to local privilege escalation. No additional execution privileges or user interaction are required for successful exploitation. The issue was patched in the September 2026 security update (patch level 2026-09-05) for all supported Pixel devices.
Affected products
- Google Pixel (all supported models) Prior to 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed: Published in Pixel Update Bulletin—September 2026
- 2026-09-05: patched: Security patch level 2026-09-05 addresses this vulnerability