Executive brief
Google Pixel devices contain multiple improper input validation flaws in kernel and firmware components that allow local attackers to escalate privileges without requiring special system access or user interaction. Successful exploitation could give an attacker full control over an affected device, compromising all stored data and enabling malware installation.
Technical details
CVE-2026-58744 is a privilege escalation vulnerability caused by improper input validation in multiple kernel and firmware subsystems on Google Pixel devices. The vulnerability affects components including bootloader, VPU, Telephony, Trusted Execution Environment, and others. Attack vector is local with low privileges required and no user interaction needed. An attacker with local code execution can exploit these validation flaws to elevate privileges to kernel or firmware level. Patches are available in the 2026-09-05 security patch level for all supported Pixel devices.
Affected products
- Google Pixel Pre-2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched: Available in September 2026 Pixel security patch