Executive brief
The Video Processing Unit (VPU) firmware in Google Pixel devices contains a vulnerability that allows improper input validation, leading to shared memory corruption. An attacker with local system access can exploit this to escalate privileges to system level, potentially compromising the security of the entire device.
Technical details
This vulnerability is a local privilege escalation (EoP) in the VPU (Video Processing Unit) component affecting Pixel devices. The root cause is improper input validation that permits shared memory overwrites. The attack vector is local with system execution privileges required. No user interaction is needed for exploitation. By corrupting shared memory structures, an attacker can escalate privileges from a lower privilege context to system level. The vulnerability was patched in the September 2026 Pixel security update (patch level 2026-09-05).
Affected products
- Google Pixel Before September 2026 patch level 2026-09-05
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched: Pixel security patch level 2026-09-05 or later