Executive brief
BigOcean is a media processing component in Google Pixel devices that handles video decoding. A missing bounds check in the film grain parameter decoder allows an attacker to write data outside allocated memory, potentially executing arbitrary code on the device without user interaction or special permissions.
Technical details
The vulnerability is an out-of-bounds write in the DecodeFilmGrainParams function of film_grain_dec.cc, caused by a missing bounds check on array access. The flaw exists in the BigOcean media subsystem, a network-reachable component that processes encoded video streams. No authentication or user interaction is required for exploitation—an attacker can trigger the overflow by sending a crafted video file or stream. Successful exploitation results in remote code execution with full device privileges. The vulnerability was patched in the 2026-09-05 security update for Google Pixel devices.
Affected products
- Google Pixel firmware prior to 2026-09-05
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched