Executive brief
A security flaw in Google Pixel devices' DreamPickerReceiver component allows a local attacker with system-level privileges to bypass permission checks through a confused deputy vulnerability. An attacker could exploit this to gain unauthorized access to protected features or data on the device. No user interaction is required for the attack to succeed.
Technical details
The vulnerability is a permission bypass due to a confused deputy attack in multiple functions of DreamPickerReceiver.kt in Google Pixel devices. The root cause is insufficient permission validation that allows a local attacker with System execution privileges to escalate their access rights by exploiting the component's trusted context. The attack vector is local with System execution privileges required; no user interaction is needed. An attacker can achieve local privilege escalation. A patch is available in Pixel security updates for 2026-09-05 patch level or later.
Affected products
- Google Pixel before 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched