CVE-2026-58721

CVE-2026-58721 is a local information disclosure vulnerability in the GSA subcomponent of Google Pixel devices, caused by uninitialized memory use in multiple locations. Exploitation requires System execution privileges and no user interaction. Google classifies this as Critical severity in the P...

CVE-2026-58721

In multiple locations, there is a possible information disclosure due to uninitialized memory use. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-79008

In multiple locations, there is a possible information disclosure due to uninitialized memory use. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58716

In multiple locations, there is a possible time-of-check to time-of-use due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-79006

In multiple locations, there is a possible time-of-check to time-of-use due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58716

CVE-2026-58716 is a time-of-check to time-of-use (TOCTOU) race condition in the GSA (Google Secure Architecture) component of Google Pixel devices, classified as a Critical severity elevation of privilege (EoP). The vulnerability requires System execution privileges and no user interaction, enabl...

CVE-2026-58701

CVE-2026-58701 affects the Trusty Trusted Execution Environment on Google Pixel devices. The vulnerable code is in the trusty_dputc function within generic-arm64-smcall.c , where a race condition can lead to an out-of-bounds write , enabling local elevation of privilege. Exploitation requires Sys...

EUVD-2026-79001

In appmicpollmsghandler of appmicipc.c, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58698

CVE-2026-58698 is a confused deputy vulnerability in the ap_pmic_poll_msg_handler function of ap_pmic_ipc.c, allowing a local escalation of privilege when the attacker already holds System execution privileges . No user interaction is required. The flaw is tied to the Android Pixel security bulle...

EUVD-2026-79000

In gmcphylp3exitrestoreregisters of phypower.c, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58678

CVE-2026-58678 is a Critical elevation-of-privilege (EoP) vulnerability in the Bootloader of supported Google Pixel devices. The root cause is a logic error that permits a permission bypass , enabling a local attacker with System execution privileges to escalate further without user interaction. ...

CVE-2026-57042

In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-78995

In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-78994

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57035

This vulnerability affects Android (Pixel) devices, as referenced by the 2026-09-01 Pixel security bulletin . The root cause is a missing bounds check in multiple locations, leading to an out-of-bounds write . The impact is a local escalation of privilege , requiring System execution privileges a...

EUVD-2026-78990

In acfwffa.c, there is a possible secret read due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57006

CVE-2026-57006 is a logic error in acfw_ffa.c within the ACFW component of Google Pixel devices, which allows a possible secret read leading to local information disclosure. The Pixel September 2026 bulletin classifies it as Elevation of Privilege (EoP) with Critical severity, though the CNA-assi...

CVE-2026-56992

CVE-2026-56992 is a permission bypass in the AP ROM component of Google Pixel devices, caused by a confused deputy flaw in multiple files. It enables local escalation of privilege with System execution privileges required and no user interaction needed. Google classifies the severity as Critical ...

CVE-2026-56989

CVE-2026-56989 is an out-of-bounds write in the Android platform (referenced in the Pixel Security Bulletin for 2026-09-01, tracked as OSV PUB-A-508704693 ) caused by a missing bounds check in multiple locations. It can lead to local escalation of privilege requiring System execution privileges ,...

EUVD-2026-78987

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...