Executive brief
Google Pixel devices contain a missing bounds check in kernel components that allows an attacker with local system access to write data outside allocated memory regions. This vulnerability can lead to privilege escalation, enabling an attacker to gain complete control over the affected device with system-level permissions.
Technical details
CVE-2026-56989 is an out-of-bounds write vulnerability caused by missing bounds checking in multiple kernel locations on Google Pixel devices. The vulnerability requires local access with system execution privileges to exploit; user interaction is not required. An attacker can leverage this flaw to corrupt memory and escalate privileges to system level. The vulnerability is addressed in the Pixel security patch level 2026-09-05 or later, released September 15, 2026.
Affected products
- Google Pixel devices Before 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched