CVE-2026-56922

CVE-2026-56922 is a permission bypass in the CPM (Camera Processing Module) component of Google Pixel devices, caused by a confused deputy flaw. It enables local escalation of privilege with System execution privileges required and no user interaction needed. The Pixel Security Bulletin rates thi...

CVE-2026-56920

CVE-2026-56920 is a Critical remote code execution vulnerability in the VPU (Video Processing Unit) component of Google Pixel devices. The flaw is an out-of-bounds write in the function s_decode_vui_param within fw_hevc_dec_header.c, caused by a logic error during HEVC video decoding. Exploitatio...

CVE-2026-56915

CVE-2026-56915 is a local privilege escalation vulnerability in the bigo_worker_thread function of bigo.c , caused by a race condition . It affects Android (Pixel) devices, as indicated by the 2026-09-01 Pixel security bulletin reference and the associated Google OSV entry (PUB-A-508686178). Expl...

CVE-2026-56914

CVE-2026-56914 is a use-after-free vulnerability in the Google eXperience Processor kernel component of Google Pixel devices, caused by improper locking in multiple locations. It allows local escalation of privilege with low privileges required and no user interaction (CVSS 3.1: 7.8 HIGH ). CISA'...

CVE-2026-56907

CVE-2026-56907 affects the VPU (Video Processing Unit) component in Google Pixel devices, as tracked in the Pixel security bulletin of 2026-09-01 and OSV entry PUB-A-510463247 . The root cause is a shared memory overwrite due to improper input validation , which can lead to local privilege escala...

CVE-2026-56892

CVE-2026-56892 is an information disclosure vulnerability in the Secure World subcomponent of Google Pixel devices, caused by an incorrect bounds check in the ReadDataElement function of common.c. An attacker with low privileges on the device can exploit this locally without user interaction to a...

CVE-2026-56889

CVE-2026-56889 is an integer overflow vulnerability in Android (tracked as PUB-A-511556070) that allows a local escalation of privilege to System-level execution. The flaw exists in multiple unspecified locations. Exploitation requires System execution privileges but no user interaction. CNA-assi...

CVE-2026-56888

CVE-2026-56888 is a permission bypass vulnerability in Android/Pixel devices caused by side channel information disclosure in multiple locations. An attacker with local access and low privileges can exploit this to achieve local privilege escalation without requiring user interaction or additiona...

CVE-2026-56882

CVE-2026-56882 affects the Cellular Modem (Telephony) component of Google Pixel devices. A logic error in the code enables information disclosure that can escalate to remote code execution with low privileges and no user interaction . The CVSS 3.1 base score is 8.8 (High) with impacts of High acr...

CVE-2026-56881

CVE-2026-56881 is a local privilege escalation vulnerability in the enable_segment function of remap.c , caused by a logic error that allows a permission bypass . The vulnerability requires only low privileges and no user interaction to exploit, rated CVSS 7.8 (HIGH) . It is referenced in the Pix...

CVE-2026-56879

CVE-2026-56879 affects Android (Pixel devices, per the 2026-09-01 security bulletin reference). The vulnerability exists in gmc_mb_msg_handler within gmc_mba.c , where a confused deputy leads to memory corruption, enabling local privilege escalation with System -level privileges required. No user...

CVE-2026-55366

CVE-2026-55366 affects the IP Multimedia Subsystem (IMS) in Android Pixel devices, as indicated by the reference to the September 2026 Pixel security bulletin. The vulnerability stems from a logic error that enables an authentication bypass , potentially leading to remote privilege escalation wit...

CVE-2026-55365

CVE-2026-55365 is an out-of-bounds write in multiple functions of remap.c in the Bootloader component of Google Pixel devices, caused by an incorrect bounds check. It enables local escalation of privilege (EoP) with System execution privileges required and no user interaction. Google rates it Cri...

CVE-2026-55359

CVE-2026-55359 is a permission bypass caused by a logic error in the GPCA subcomponent of Google Pixel devices. It allows a local escalation of privilege from a low-privilege user account to full device compromise, with no user interaction required. The Pixel Update Bulletin rates it as Critical ...

CVE-2026-55351

CVE-2026-55351 affects the VPU (Video Processing Unit) component, as reported by Qualcomm 's CNA (dsap-vuln-management ). The root cause is an integer overflow that leads to an out-of-bounds write , enabling local privilege escalation with low privileges required and no user interaction. The vuln...

CVE-2026-55343

CVE-2026-55343 is a critical out-of-bounds write vulnerability in the decodeAmr function of ImsMediaAudioPlayer.cpp , a component within libpixelimsmedia on Google Pixel devices . The missing bounds check allows an attacker to achieve remote code execution with low privileges and required user in...

CVE-2026-55332

CVE-2026-55332 is an out-of-bounds write vulnerability in multiple locations within Android (referenced in the Pixel September 2026 security bulletin), caused by improper input validation . It allows local escalation of privilege but requires System-level execution privileges and needs no user in...

CVE-2026-55331

CVE-2026-55331 affects Google Pixel devices in the IP Multimedia Subsystem (Telephony subcomponent). The root cause is an out-of-bounds write due to an incorrect bounds check, which can lead to remote code execution with no additional privileges and no user interaction required. The vulnerability...

CVE-2026-55323

CVE-2026-55323 is a heap buffer overflow (out-of-bounds write) in the Goodix Fingerprint TA (Trusted Application) on supported Pixel devices , specifically in the function gf_base_update_finger_base of gf_base.c. It allows local elevation of privilege with low privileges and no user interaction, ...

CVE-2026-55318

CVE-2026-55318 is a use-after-free vulnerability caused by a race condition in multiple locations within the IP Multimedia Subsystem (IMS) on Google Pixel devices . It enables remote code execution without requiring additional privileges or user interaction. The vulnerability is rated Critical in...