Executive brief
The cellular modem firmware in Google Pixel devices contains a heap buffer overflow vulnerability that allows an attacker with network or adjacent network access to execute arbitrary code remotely without user interaction. A successful exploit could compromise the integrity of the device, intercept communications, or establish a persistent foothold for further attacks.
Technical details
The vulnerability is a heap buffer overflow in the cellular modem component that results in an out-of-bounds write condition. This memory safety issue can be triggered via a network or adjacent-network attack vector without requiring elevated privileges or user interaction. Successful exploitation leads to remote code execution (RCE) on the modem firmware. The vulnerability is patched in Google Pixel devices with the 2026-09-05 security patch level or later; patches are available through AOSP.
Affected products
- Google Pixel before 2026-09-05 security patch
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched