Executive brief
Google Pixel devices include a Setup Wizard component used during initial device configuration that fails to properly validate user permissions before allowing remote package installations. An attacker can exploit this missing check to install unauthorized packages and gain elevated privileges on the device without requiring any additional execution rights or user interaction, potentially gaining full control of the device.
Technical details
The vulnerability is a privilege escalation (EoP) flaw in the Setup Wizard component caused by insufficient permission validation during remote package installation operations. The attack vector is network-based with no preconditions—an attacker can trigger arbitrary package installation without authentication or user consent. By exploiting this missing permission check, an attacker achieves escalation to higher privilege levels, leading to potential full device compromise. Google has issued patches as part of the September 2026 security update (patch level 2026-09-05 or later).
Affected products
- Google Pixel prior to 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched: Patch available via September 2026 Pixel security update