Executive brief
A logic flaw in the GDMC (Google Device Management Component) firmware on Google Pixel devices allows local attackers to escalate privileges to system level without user interaction. GDMC is a core firmware component responsible for device management and security functions; exploitation of this flaw would allow an attacker with local access to take full control of the device.
Technical details
A confused deputy vulnerability exists in the platform_msg_handler_init function of default_msg_handlers.c in the GDMC component. The vulnerability arises from improper privilege context handling that allows a local attacker to abuse the message handling mechanism to execute code with system-level privileges. No user interaction is required for exploitation. The issue affects Google Pixel devices and is addressed in the September 2026 security patch (2026-09-05 or later). GDMC runs with elevated privileges, making this a high-impact escalation vector.
Affected products
- Google Pixel before 2026-09-05 security patch
Timeline
- 2026-09-15: disclosed: Published in Pixel Update Bulletin
- 2026-09-05: patched: Security patch level 2026-09-05 or later addresses this issue