Executive brief
Google Pixel devices use a VP9 video decoder to process compressed video content. A missing bounds check in the ReadTileInfo function could allow an attacker to trigger an out-of-bounds write when processing a specially crafted video file, leading to privilege escalation without requiring user interaction or additional execution privileges.
Technical details
The vulnerability exists in vp9hwd_headers.cc in the ReadTileInfo function, where a missing bounds check on array indexing permits an out-of-bounds write. The VP9 decoder processes video tile information from untrusted input without proper validation of buffer boundaries. An attacker can exploit this by providing a specially crafted VP9 video stream over the network or via other means, causing memory corruption that leads to escalation of privilege. The vulnerability affects Google Pixel devices and is addressed in the September 2026 security patch level (2026-09-05 or later).
Affected products
- Google Pixel Prior to 2026-09-05 security patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched