Executive brief
Google Pixel devices contain a logic error in permission-checking code across multiple components that allows an attacker with system-level access to bypass security controls and gain elevated privileges. While this requires initial system-level execution capability, the vulnerability could enable an attacker to compromise device security and access sensitive data or functionality normally restricted by the operating system.
Technical details
This vulnerability is a permission bypass resulting from a logic error in authorization checks across multiple Pixel device components. The flaw allows local privilege escalation to system execution level without requiring user interaction. The attack requires the attacker to already have system-level execution privileges, which typically means this would be exploited as a second-stage payload following initial device compromise. Google has patched this issue in Pixel devices with the 2026-09-05 security patch level or later.
Affected products
- Google Pixel prior to 2026-09-05 security patch
Timeline
- 2026-09-15: published
- 2026-09-05: patched