What is the CVSS score of CVE-2026-0163?

CVE-2026-0163 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of Android Kernel are affected by CVE-2026-0163?

CVE-2026-0163 is a critical privilege escalation in Android kernel VPU drivers affecting Google Pixel and Android devices, allowing unauthenticated attackers to gain complete kernel-level control…

How to fix or mitigate CVE-2026-0163?

Within 24 hours: Conduct immediate inventory of all Google Pixel and Android devices across your organization and identify which have network access or contain sensitive data. Within 7 days: Implement network segmentation to isolate vulnerable Android devices from corporate infrastructure and critical systems; document VPU driver configurations across your device fleet and evaluate operational feasibility of disabling the driver where safe to do so; establish daily automated monitoring of Google Android Security & Privacy Bulletins and CISA advisories for patch availability. Within 30 days: Develop and test a rapid deployment strategy for the security patch once Google releases it; coordinate with device management teams to ensure staged rollout capability; prepare user communications explaining the vulnerability and interim protective measures; document any deployed compensating controls for audit and compliance purposes.

Android Kernel CVE-2026-0163

EUVD-2026-52864 CRITICAL

Use After Free (CWE-416)

2026-08-04 Google_Devices

GHSA-6744-29jh-3wrc

Privilege Escalation Denial Of Service Google Use After Free Memory Corruption

9.8

CVSS 3.1 · Vendor: Google_Devices

Severity by source

Vendor (Google_Devices) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Kernel VPU driver is reached via local ioctl from an installed app, so AV:L and PR:L; the UAF yields full kernel compromise giving C:H/I:H/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Google_Devices).

CVSS VectorVendor: Google_Devices

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 21:26 vuln.today

CVE Published

Aug 04, 2026 - 18:31 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 18:31 cve.org

CRITICAL 9.8

DescriptionCVE.org

In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

AnalysisAI

Privilege escalation in the Android kernel VPU (Video Processing Unit) driver stems from a use-after-free in vpu_ioctl.c, allowing an attacker to elevate to kernel-level privileges without any additional execution privileges or user interaction. It affects Google Android devices (per the Pixel security bulletin for 2026-08-01), and Android's advisory states no user interaction is required; SSVC rates the technical impact as total and the flaw as automatable. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the total-impact, no-interaction profile makes it a high-priority patch target.

Technical ContextAI

The root cause is CWE-416 (Use After Free) in multiple functions of vpu_ioctl.c, the ioctl handler for the Video Processing Unit kernel driver used on Android/Pixel SoCs. A use-after-free occurs when kernel code continues to reference an object after it has been freed, letting an attacker reclaim that freed memory with attacker-controlled data and manipulate kernel structures (such as function pointers) to hijack execution flow. Because VPU drivers are exposed to userspace through ioctl system calls, a local application interacting with the VPU device node can trigger the dangling reference. The CPE cpe:2.3:a:google:android identifies Google Android as the affected platform, specifically the Android kernel component shipped in Pixel firmware.

RemediationAI

Patch available per vendor advisory: apply the Android security patch level corresponding to the Google Pixel bulletin dated 2026-08-01 (https://source.android.com/docs/security/bulletin/pixel/2026/2026-08-01) as soon as it is offered by the device OEM, since this is the primary and recommended fix. No exact fixed version string is provided in the input, so confirm the required security patch level directly from that bulletin before deployment. As a compensating control until patched, restrict installation of untrusted third-party applications (the realistic vector for reaching the VPU ioctl interface) and use OEM/MDM controls to block sideloading and unknown sources; on managed fleets, enforce update deferral policies. There is no documented toggle to disable the VPU driver without breaking media and camera functionality, so device-level app-trust hardening is the practical interim mitigation and its trade-off is reduced ability to install legitimate third-party apps.