Executive brief
Multiple firmware and system components in Google Pixel devices contain a missing permission check that allows local attackers to escalate privileges without requiring special execution rights or user interaction. This vulnerability affects critical device functions and could enable unauthorized access to sensitive operations and data on affected Pixel phones.
Technical details
The vulnerability is a privilege escalation flaw caused by missing permission checks in multiple locations across Google Pixel firmware and system components. The attack vector is local, requiring no additional execution privileges and no user interaction for successful exploitation. By exploiting this permission bypass, an attacker with local access can escalate their privileges to perform unauthorized operations on the device. The issue has been addressed in the September 2026 security patch (2026-09-05 patch level) across affected Pixel components.
Affected products
- Google Pixel 2026-09-05 patch level and later
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched