Executive brief
The Pixel device bootloader contains an integer overflow vulnerability that can be exploited to bypass permission checks and gain system-level privileges. An attacker with local access to the device can exploit this flaw to escalate privileges without user interaction, potentially gaining complete control over the device.
Technical details
This vulnerability is an integer overflow flaw occurring in multiple locations within the Pixel bootloader that leads to a permission bypass. The integer overflow allows an attacker to circumvent privilege checks, resulting in local escalation of privilege with System execution privileges. The attack vector is local, requiring physical or logical access to the device. No user interaction is required for exploitation. The vulnerability was patched in the September 2026 security update (patch level 2026-09-05 or later).
Affected products
- Google Pixel Bootloader Prior to 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched