EUVD-2026-37186
GHSA-8wwq-p6c4-57j3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessRun malicious app on device
-
DeliveryOpen PMR/GPU memory mapping via mmap
-
ExploitIssue crafted syscall sequence
-
ExecutionTrigger out-of-bounds VMA expansion
-
PersistCorrupt kernel memory
-
ImpactEscalate to root privileges
Vulnerability Assessment
| Weakness |
CWE
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires local code execution on the affected Android device: the attacker must run code as an unprivileged/low-privilege local user or app (PR:L, AV:L) capable of invoking the relevant system calls against a PMR memory mapping handled by OSMMapPMRGeneric in pmr_os.c. The concrete prerequisite is the ability to open and mmap the PowerVR/PMR GPU memory-resource interface and issue the crafted system-call sequence that triggers the out-of-bounds VMA expansion. No user interaction is needed and no additional execution privileges are required (UI:N). Limiting factors: exploitation is local only (no network vector), the device must be running an unpatched pre-2026-06-01 kernel containing the affected PowerVR/PMR driver, and the attacker needs an existing means to execute code on the device (e.g., an installed malicious or compromised app). |
| Impact | Signals are consistent and point to a genuine but not urgent priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) describes a low-complexity, locally exploitable flaw requiring only low privileges (an installed app / local user) and no user interaction, with total confidentiality, integrity, and availability impact - matching the SSVC assessment of 'Technical Impact: total.' However, SSVC 'Exploitation: none' and 'Automatable: no,' an EPSS of 0.07% (0th percentile), and the absence of KEV listing all indicate no observed real-world exploitation and no public exploit at this time. The requirement for local code execution (PR:L, AV:L) meaningfully limits reach: this is a privilege-escalation building block, not a remote entry point. Net assessment: patch on the normal Android security-bulletin cadence rather than emergency response, while noting that local EoP bugs of this class are frequently paired with a separate remote/app-level foothold in real attacks. |
| Exploit ScenarioDerived | A malicious app installed on the device (or code running after an initial low-privilege foothold) issues a crafted sequence of system calls against a PMR mmap object to trigger the out-of-bounds VMA expansion in OSMMapPMRGeneric, corrupting kernel memory to elevate from an unprivileged app context to root. No user interaction is required and attack complexity is low, but the attacker must already be able to run code locally on the device. No public proof-of-concept is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 22, 2026
Local privilege escalation in the Android kernel affects Pixel and other Android devices through a logic error in OSMMapPMRGeneric within pmr_os.c, the PowerVR/Imagination-style PMR (Physical Memory Resource) memory-management code. A local attacker chaining system calls can maliciously expand a Virtual Memory Area (VMA) out of bounds, corrupting kernel memory to gain root-equivalent privileges. Rated CVSS 7.8 with no public exploit identified at time of analysis; EPSS is 0.07% and CISA SSVC reports no observed exploitation, indicating this is a patched-early, not-yet-weaponized issue.
RemediationAI
Apply the Android security update that includes this fix: install the June 2026 (2026-06-01) security patch level or later as published in the Pixel Update Bulletin (https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01); Patch available per vendor advisory, though an exact numeric fix version is not enumerated in the provided data. Device owners should update to the latest OTA build for their model, and OEMs integrating the affected PowerVR/PMR driver should pull the corresponding upstream kernel fix. Where immediate patching is impossible, compensating controls are limited because the flaw is reachable by any locally running code: restrict installation to trusted applications and enforce app vetting/MDM allowlisting to reduce the chance of malicious local code, and where feasible on managed fleets restrict access to the GPU device nodes to trusted processes - noting this can break legitimate graphics/compute workloads and is not a substitute for the vendor patch.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerable routine OSMMapPMRGeneric in pmr_os.c handles mmap() of PMR (Physical Memory Resource) objects, a memory-management abstraction characteristic of the Imagination Technologies PowerVR GPU kernel driver commonly integrated into Android/Pixel kernels. A logic error in bounds handling lets a crafted sequence of system calls (mmap/related VMA operations) grow the mapped VMA beyond its intended size, mapping or exposing kernel-managed memory outside the allocation. This maps to CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer): the driver fails to enforce the boundary of the memory region during the mapping/expansion operation, enabling out-of-bounds access. Because the affected code is a device driver operating in kernel context, successful corruption directly undermines kernel-level memory isolation.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local attacker with low-privilege app access and no user interaction corrupts kernel memory for full privilege escalation, yielding total C/I/A impact.
Primary rating from Vendor (Google_Devices).
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
2DescriptionCVE.org
In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bounds due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Executive ViewAI
An unpatched local privilege escalation in the Android kernel (CVE-2026-0152, CVSS 7.8) affects Pixel and other Android devices, allowing a local attacker to gain root-equivalent privileges through kernel memory corruption. While no active exploitation has been observed and exploitation probability is low (EPSS 0.1%), the absence of a vendor patch means affected organizations must implement interim access controls until remediation becomes available.
No vendor-released patch identified at time of analysis. Interim mitigations: restrict local device access through mobile device management (MDM) policies; disable physical debug interfaces; monitor for anomalous system call patterns that may indicate exploitation attempts; ensure devices are running the latest available stable kernel build from the vendor; isolate affected devices from sensitive network segments where feasible.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Exploit-DB