Executive brief
A race condition vulnerability in the Pixel device firmware allows a local attacker with system-level access to escalate privileges further through a timing attack in the bigo worker thread. Exploitation requires the attacker to already be running code on the device at system level, but no user interaction is needed once the necessary privileges are obtained. Successful exploitation could allow an attacker to gain deeper control of device functionality.
Technical details
The vulnerability is a race condition in the bigo_worker_thread function within bigo.c, a firmware component on Google Pixel devices. The flaw allows privilege escalation when an attacker with existing system execution privileges can exploit a timing window in thread synchronization. No user interaction is required for exploitation. The attack is local and requires the attacker to already have elevated privileges on the target device. Google issued patches in the September 2026 security bulletin (patch level 2026-09-05 or later) to address this issue.
Affected products
- Google Pixel Before 2026-09-05 security patch level
Timeline
- 2026-09-15: disclosed: Published in Pixel Update Bulletin—September 2026
- 2026-09-05: patched: Addressed in security patch level 2026-09-05 or later