CVE-2026-0124

The vulnerability is classified as CWE-787 (out of bounds write) and results from omission of buffer boundary checks before data writing. An attacker with local access to the device can trigger a write operation outside the permitted memory area, allowing manipulation of data structures or code in the process memory. The lack of any user interaction requirement and the lack of need for additional execution privileges significantly lower the entry threshold for the attacker.

An attacker can achieve privilege escalation on the local device, potentially taking control of the operating system or its critical components. In a maximum threat scenario, complete takeover of the device is possible.

Security patches available from the manufacturer should be applied according to references — Pixel Security Bulletin available at: https://source.android.com/docs/security/bulletin/pixel/2026/2026-03-01

Google Android — versions indicated in manufacturer references (Pixel Security Bulletin from March 2026)