EUVD-2026-37192
GHSA-hm6m-fqm4-j6w8
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Local attack vector and low privileges confirmed by requirement for on-device code execution; only partial confidentiality impact as access is limited to photos.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
The Camera component on Android (Google Pixel) permits unauthorized photo access due to a missing permission check, classified under CWE-862 (Missing Authorization). A locally present attacker holding only low-level privileges can read photo data without requiring any user interaction or elevated execution rights. No public exploit code exists and EPSS sits at the 0th percentile, making this a low-urgency, locally scoped disclosure issue per all available intelligence signals.
Technical ContextAI
CWE-862 (Missing Authorization) describes a failure to verify that a caller has the required permission before granting access to a protected resource. In Android's permission model, access to media such as photos is gated by runtime permissions; when a Camera component bypasses or omits this check, any co-resident app or process with low-privilege code execution can invoke the vulnerable component and read photo data directly. The affected product per CPE is cpe:2.3:a:google:android:*:*:*:*:*:*:*:*, covering the Android platform broadly, though the reporting entity is Google_Devices and the reference advisory is the Pixel-specific bulletin, suggesting the confirmed exposure is on Pixel hardware running the affected Camera build.
RemediationAI
Apply the patch distributed via the June 2026 Pixel Security Bulletin, available at https://source.android.com/docs/security/bulletin/pixel/2026/2026-06-01. Users should ensure their Pixel device has received the 2026-06 security update, which addresses this missing permission check in the Camera component. No exact patched build number is specified in the available input data, so administrators should verify the installed security patch level is 2026-06-01 or later via device settings. No documented workarounds are available; however, reviewing and restricting the set of installed apps with background code execution privileges reduces the realistic attacker surface for local exploitation.
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today