Executive brief
Google Pixel devices contain a logic error in GPU driver code that allows an attacker with system-level access to bypass permission checks and escalate privileges. An attacker who has already gained local access to a device can exploit this flaw to gain full system control, potentially enabling malware installation or data theft.
Technical details
This vulnerability is a permission bypass in the GPU driver due to a logic error in permission validation code. The flaw allows local privilege escalation when system execution privileges are required, and no user interaction is needed for exploitation. The attack vector is local only. Google released patches as part of the Pixel Update Bulletin dated September 15, 2026, with all supported Pixel devices receiving updates to patch level 2026-09-05 or later.
Affected products
- Google Pixel Prior to 2026-09-05 patch level
Timeline
- 2026-09-15: disclosed
- 2026-09-05: patched: Patch level 2026-09-05 or later addresses this issue