Android Kernel CVE-2026-0143

Exploitation requires local code execution on an affected Google Pixel device (an installed/running app or process), reaching the LWIS imaging driver's external-event handling in lwis_device_external_event_emit; no user interaction is needed. The Android bulletin states System execution privileges are needed for exploitation, meaning the attacker must already hold a meaningful local privilege level before triggering the flaw - this is the primary limiting factor and narrows the realistic attacker to already-resident local code rather than remote or unprivileged actors. Exploitation is further limited to devices shipping the vulnerable LWIS driver (Pixel/Google kernel builds); the specific triggering configuration or sequence is not described in the available sources.

This is a genuine but not emergency-level priority. The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a local, low-complexity attack that needs some pre-existing privilege (PR:L) and no user interaction, with total impact to confidentiality, integrity and availability on the affected device - consistent with a kernel use-after-free (CWE-416) in the LWIS camera driver. The signals point away from urgency rather than toward it: EPSS is 0.07% (0th percentile), SSVC reports Exploitation: none and Automatable: no (while Technical Impact: total), there is no CISA KEV listing, and no public exploit or PoC reference is present in the input. The vuln.today 'this_week' priority is therefore driven by the total technical impact and the monthly-bulletin patch cadence, not by observed exploitation. Note one tension that should be verified: the Android description states 'System execution privileges needed for exploitation,' which implies the attacker must already hold System-level privileges, yet the supplied vector uses PR:L - the practical bar may be higher than PR:L suggests, which further narrows the realistic attacker set. Net: a real local EoP worth patching on the normal Pixel update cycle, not a drop-everything issue given the local vector, required privileges, and absence of exploitation signals.

A malicious or compromised app already running locally on an affected Google Pixel device triggers the use-after-free in lwis_device_external_event_emit by driving the LWIS imaging driver's external-event path, corrupting kernel memory to escalate from its existing privilege level toward kernel/System control. No user interaction is required. No public exploit or PoC was identified in the available sources, and the exact trigger sequence is not described in the available sources.