EUVD-2026-79146
GHSA-xw5h-2294-wjv4
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Google_Devices) · only source for this CVE.
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
3DescriptionCVE.org
In Vp9DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
An out-of-bounds write in Android's VP9 hardware decoder (Vp9DecodeFrameTag in vp9hwd_headers.cc) lets a crafted VP9 video stream corrupt memory in the codec context, giving an attacker code execution at the decoder's privilege level. Affected devices are those running Android builds that include the vulnerable VP9 hardware decoding path prior to the September 2026 Pixel security bulletin fix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today