Executive brief
A missing bounds check in the Bootloader's global configuration handler allows a local attacker to read memory outside intended boundaries, potentially exposing sensitive data or enabling privilege escalation. This vulnerability affects Google Pixel devices and requires no special privileges or user interaction to exploit.
Technical details
The vulnerability exists in get_global_config_item_addr() within gc.c in the Bootloader component, where a missing bounds check allows an out-of-bounds read. An attacker with local access can trigger this flaw to read arbitrary memory locations, potentially accessing sensitive bootloader state, cryptographic material, or other protected data. The attack is local in nature, requires no additional execution privileges, and user interaction is not required. A patch was available as of the September 2026 security update (2026-09-05 patch level or later).
Affected products
- Google Pixel Pre-2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched