Executive brief
An out-of-bounds memory read flaw affecting Google Pixel devices allows a local attacker to escalate privileges and gain elevated system access without requiring additional permissions or user interaction. This type of vulnerability typically enables attackers to bypass security controls and take complete control of the device.
Technical details
CVE-2026-56986 is an out-of-bounds read vulnerability caused by type confusion in multiple kernel files affecting Google Pixel devices. The vulnerability exists in a privileged component and can be exploited by a local attacker to achieve privilege escalation without requiring additional execution privileges or user interaction. The flaw was patched in the Android security patch level 2026-09-05 and later; affected Pixel devices will receive updates automatically through the September 2026 Pixel Update Bulletin.
Affected products
- Google Pixel Before 2026-09-05 security patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched