EUVD-2026-78970
GHSA-g689-j56f-p5hx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Google_Devices) · only source for this CVE.
CVSS VectorVendor: Google_Devices
Lifecycle Timeline
4DescriptionCVE.org
In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
AnalysisAI
Local privilege escalation in Google Android's VPU (Video Processing Unit) driver lets an unprivileged app trigger an out-of-bounds write through a confused-deputy path, corrupting kernel memory and gaining root-level code execution on the device. Per the CVSS vector, the attacker must already hold local code execution (PR:L) but needs no user interaction, and the September 2026 Pixel/Android Security Bulletin confirms a vendor fix. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today