CVE-2026-58678

CVE-2026-58678 is a Critical elevation-of-privilege (EoP) vulnerability in the Bootloader of supported Google Pixel devices. The root cause is a logic error that permits a permission bypass , enabling a local attacker with System execution privileges to escalate further without user interaction. ...

CVE-2026-57042

In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-78995

In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-78994

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57035

This vulnerability affects Android (Pixel) devices, as referenced by the 2026-09-01 Pixel security bulletin . The root cause is a missing bounds check in multiple locations, leading to an out-of-bounds write . The impact is a local escalation of privilege , requiring System execution privileges a...

EUVD-2026-78990

In acfwffa.c, there is a possible secret read due to a logic error in the code. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-57006

CVE-2026-57006 is a logic error in acfw_ffa.c within the ACFW component of Google Pixel devices, which allows a possible secret read leading to local information disclosure. The Pixel September 2026 bulletin classifies it as Elevation of Privilege (EoP) with Critical severity, though the CNA-assi...

CVE-2026-56992

CVE-2026-56992 is a permission bypass in the AP ROM component of Google Pixel devices, caused by a confused deputy flaw in multiple files. It enables local escalation of privilege with System execution privileges required and no user interaction needed. Google classifies the severity as Critical ...

CVE-2026-56989

CVE-2026-56989 is an out-of-bounds write in the Android platform (referenced in the Pixel Security Bulletin for 2026-09-01, tracked as OSV PUB-A-508704693 ) caused by a missing bounds check in multiple locations. It can lead to local escalation of privilege requiring System execution privileges ,...

EUVD-2026-78987

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56989

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-78986

In multiple functions of bluetoothcco.cc, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56988

CVE-2026-56988 is a use-after-free vulnerability caused by a race condition in multiple functions of bluetooth_cco.cc , an Android Bluetooth component. It allows local escalation of privilege with System execution privileges required and no user interaction. The CVSS v3.1 score is 6.4 (Medium) wi...

EUVD-2026-78983

In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56982

In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-78982

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56979

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-56979

CVE-2026-56979 is a permission bypass in Android (referenced in the Pixel security bulletin for 2026-09-01) caused by a logic error in multiple code locations . An attacker with System execution privileges can achieve local escalation of privilege without user interaction. The vulnerability is ra...

CVE-2026-56975

CVE-2026-56975 affects the Cellular Modem component in Google Pixel devices (referenced in the Pixel September 2026 security bulletin ). The root cause is improper input validation , which can lead to a remote proximal/adjacent denial of service with low privileges required and no user interactio...

CVE-2026-56973

CVE-2026-56973 is a local elevation of privilege in the GDMC subcomponent of Google Pixel devices, caused by a logic error in the code. An attacker with System execution privileges can exploit it to gain higher privileges, with no user interaction required. The vulnerability is rated Critical sev...