Google Android CVE-2026-0187

Exploitation requires local code execution already holding System execution privileges (PR:H) on an affected Android/Pixel device - no user interaction is needed (UI:N). The specific trigger is the logic error in the gsa_sw_pk_hash_compare public-key hash-comparison routine within image-auth-srv.c (image authentication service). Limiting factors: this is not remotely reachable (AV:L), and the pre-required System-level privilege sharply narrows the realistic attacker set to already-compromised or malicious high-privilege components, so it functions as an escalation-from-System-to-more-trusted-context rather than an initial foothold.

All exploitability signals point to a low-urgency, defense-in-depth issue rather than an active priority. The CVSS 3.1 vector (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, vendor base 6.7 Medium) requires local access AND System-level execution privileges (PR:H) - meaning the attacker must already be highly privileged before triggering the logic error in gsa_sw_pk_hash_compare. EPSS is 0.12% (2nd percentile), consistent with no realistic mass-exploitation interest. There is no CISA KEV listing and no public exploit identified at time of analysis, so exploitation status is 'no public exploit identified at time of analysis.' The C:H/I:H/A:H impact triad is the generous Android-bulletin boilerplate: since the precondition is already System privileges, the marginal escalation (likely into a more trusted context such as image/boot authentication) is real but its incremental confidentiality/availability impact is arguably overstated. No conflicting signals across sources - CVSS local vector aligns with the 'local escalation of privilege' description. Net: a legitimate hardening fix worth patching on the normal Pixel bulletin cadence, not an emergency.

A malicious or compromised process already running with System execution privileges on a Pixel/Android device invokes the flawed public-key hash comparison in image-auth-srv.c (gsa_sw_pk_hash_compare) to defeat an image-authentication check via the logic error, escalating into a more trusted context. No user interaction is required. No public proof-of-concept exists, and the high starting-privilege prerequisite (PR:H) makes opportunistic exploitation unlikely.