Executive brief
A logic error in Google Pixel device firmware (GDMC component) allows attackers to escalate privileges to system level without requiring user interaction. This gives attackers complete control over the device, enabling them to access sensitive data, modify system settings, install malware, or use the device as a network attack platform.
Technical details
A logic error in the GDMC (Google Dynamic Memory Controller) component of Pixel device firmware enables local privilege escalation to system execution privileges. The vulnerability does not require user interaction or network access—only local access to the device. An attacker with initial local code execution can trigger this logic flaw to gain system-level permissions. Google released security patches on 2026-09-05 addressing this issue across all supported Pixel devices. The fix is available in the Pixel Update Bulletin—September 2026.
Affected products
- Google Pixel Prior to 2026-09-05 security patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched