Google Pixel
CVE-2025-36934
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessInstall/run unprivileged app on device
-
DeliveryOpen BIGO codec device node
-
ExploitTrigger concurrent codec ops racing worker thread
-
ExecutionWin use-after-free window and reclaim freed object
-
PersistExecute code in kernel context
-
ImpactEscalate to full device privileges
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the attacker to already execute code locally on an affected device (e.g. an installed unprivileged app) that can access the BIGO hardware-video-codec device interface backed by google-modules/video/gchips/bigo.c - this limits exposure to Pixel/Tensor-class devices shipping that module, not all Android. No authentication or user interaction is needed once code runs locally, but the CWE-362 race condition (AC:H) means exploitation depends on winning a narrow timing window between concurrent codec operations and the bigo_worker_thread, typically requiring multiple attempts and heap control, which reduces reliability versus a deterministic bug. |
| Impact | This is a genuine but access-gated local privilege escalation, not a remote critical. The CVSS 3.1 vector (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 7.4) tells a coherent story: exploitation is LOCAL (attacker must already run code on the device), high-complexity (AC:H, reflecting the timing-dependent race window in a CWE-362 use-after-free), needs no privileges (PR:N - any unprivileged app can reach the driver), and no user interaction. Full CIA impact (C:H/I:H/A:H) is consistent with kernel UAF that yields code execution in kernel context. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no signal of active or automated exploitation; the AC:H race also raises the practical bar (kernel UAF races are typically won with heap-grooming and repeated attempts, not a one-shot). No SSVC decision data was supplied. Bottom line: a real, exploitable kernel LPE worthy of patching on affected Pixel/Tensor devices, but reliability is constrained by the race window and it is not a drop-everything remote issue. Note the 'Denial Of Service' tag understates the flaw - the primary documented impact is privilege escalation, not merely DoS. |
| Exploit ScenarioDerived | A malicious or compromised app installed on an affected Pixel device opens the BIGO video-codec device node and issues concurrent operations to trigger the use-after-free race in bigo_worker_thread. By winning the timing window and controlling the freed kernel object's reallocation, the app gains kernel-level code execution, escalating from an unprivileged app sandbox to full device compromise with no user interaction. No public exploit was identified at time of analysis, though the flaw was found/reported via Google Project Zero (issue 426567975). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Local privilege escalation on Google Pixel (Tensor) devices stems from a use-after-free race condition in the BIGO hardware video codec driver shipped as private/google-modules/video/gchips/bigo.c, where concurrent codec operations can free memory still referenced by bigo_worker_thread. An unprivileged app that already runs code locally and can reach the BIGO device interface can win the timing window and gain kernel-level execution with high confidentiality and integrity impact, requiring no authentication and no user interaction. Exposure is limited to Pixel/Tensor-class Android devices that ship this module, and because the bug is race-dependent (CVSS AC:H) exploitation typically requires repeated attempts and heap grooming; no public exploit code has been identified at time of analysis.
RemediationAI
Apply the fix delivered through the December 2025 Android/Pixel Security Bulletin for the affected Pixel/Tensor devices (https://source.android.com/security/bulletin/pixel/2025-12-01); patch availability is documented per the vendor advisory, and the exact device build version should be confirmed against the bulletin's patch table rather than assumed from the CVE alone. Until the updated build is flashed, the practical compensating controls are to minimize the local attack surface by avoiding installation of untrusted or sideloaded apps on affected devices and by using managed-device policies that restrict which applications can run and which media/codec interfaces they may touch; the trade-off is reduced functionality for apps that legitimately rely on hardware video encode/decode, since blocking or sandboxing access to the BIGO codec device interface degrades video performance or playback. Because exploitation requires only local code execution plus winning a narrow timing race, detection is difficult and there is no reliable configuration switch that removes the race without the vendor kernel update; enterprise administrators should prioritize OTA updates on Pixel fleets, monitor for anomalous local privilege-escalation behavior, and treat rooted or unmanaged Pixel devices as higher-risk until patched. Additional technical detail on the underlying race is available at https://project-zero.issues.chromium.org/issues/426567975.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified CWE-362 (concurrent execution using a shared resource with improper synchronization) and manifests as a use-after-free, meaning unsynchronized access between concurrent video-codec operations and the driver's bigo_worker_thread can free an object while another thread still holds a pointer to it, corrupting kernel heap state. BIGO (Big Ocean) is Google's hardware video codec IP integrated into Tensor SoCs, and the affected code lives in the vendor kernel module tree under private/google-modules/video/gchips/bigo.c, which backs a codec device interface reachable by local processes. The CVSS vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H confirms a local attack path with a high-complexity race as the only barrier and no privilege or interaction prerequisites, while the CPE cpe:2.3:o:google:android:-:*:*:*:*:*:*:* reflects that the vulnerable component is part of the Android/Google device kernel rather than a standalone cross-platform package.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Local app access (AV:L) with no privileges (PR:N) and no interaction; AC:H for the timing-dependent race; kernel UAF yields full C/I/A within the unchanged kernel scope.
Primary rating from Vendor (google).
CVSS VectorVendor: google
DescriptionCVE.org
In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
CVE-2025-36934 is a high-severity local privilege escalation flaw affecting Google Pixel devices with Tensor chips, where a malicious app already on the device could gain kernel-level control and access sensitive data or tamper with system integrity. Because there is no vendor-released patch identified at time of analysis and no public exploit identified at time of analysis, leadership should treat this as a fleet-wide mobile risk requiring immediate inventory and interim controls. The primary business concern is potential compromise of corporate data and device trust on affected Pixel/Tensor devices in the enterprise.
No vendor-released patch identified at time of analysis; interim mitigations include enforcing mobile threat defense, blocking sideloading and unknown sources, app allowlisting, restricting sensitive data access in work profiles, monitoring for anomalous app behavior, and isolating high-risk Pixel/Tensor devices until a vendor patch is available.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
GitHub PoC
Exploit-DB