Google Android CVE-2026-0138

Requires local code execution on an affected Google Pixel/Tensor device with the ability to reach the LWIS (Lightweight Imaging Subsystem) kernel driver interface and invoke the lwis_io_buffer_write path (AV:L). No user interaction is needed (UI:N). Limiting factors: there is no remote or network vector, so the attacker must already have a foothold on the device; per the Android bulletin the escalation is described as needing 'System execution privileges,' and access to the LWIS device is typically restricted to privileged camera/system components, which constrains who can reach the vulnerable code (consistent with PR:L, possibly higher). Exploitation is device-specific to Google imaging hardware rather than all Android builds.

This is a locally-exploitable kernel memory-corruption flaw (CVSS 7.8, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) in the Google LWIS imaging driver (lwis_io_buffer_write). The signals are internally consistent but point to contained, not widespread, risk: the attack vector is LOCAL (AV:L), so there is no remote exposure, and an attacker must already be running code on the device. SSVC reinforces this - Exploitation: none (no observed attacks), Automatable: no (cannot be mass-scripted across targets), though Technical Impact: total (full compromise once triggered). EPSS is 0.07% (0th percentile), indicating a very low modeled probability of exploitation in the near term, and there is no CISA KEV listing and no public exploit reference in the supplied data. These low-urgency signals (EPSS near zero, SSVC Exploitation none, no KEV/POC) are consistent with the vuln.today 'this_week' priority rather than an emergency. The only tension is interpretive: NVD assigns PR:L while the Android bulletin wording states 'System execution privileges needed,' which could imply the exploit already requires elevated (System) context - verify the exact required privilege with the Pixel bulletin, as it affects how much real escalation is gained. Net: a genuine high-severity local EoP primitive worth patching on schedule, but not a drop-everything internet-facing threat.

A malicious or compromised app/process already running on an affected Google Pixel/Tensor device opens the LWIS device interface and issues a crafted lwis_io_buffer_write request that drives an out-of-bounds write, corrupting kernel memory to escalate to System privileges. No user interaction is required (UI:N). No public exploit code was identified in the provided sources; the specific trigger mechanics are not described in the available data beyond 'memory corruption' / out-of-bounds write.