There is a logic error in several parts of the Android OS code that can allow a permission bypass, enabling local privilege escalation to system execution privileges without any user interaction. This flaw corresponds to improper privilege management, allowing processes to gain higher levels of access than intended.

Google Android devices, included in the Pixel security bulletin for September 2026. No specific OS version numbers are provided, but any.

The flaw can be exploited locally by an attacker with physical or local access to the device. The CVSS base score of 6.7 indicates a moderate severity, with potential for system-level execution once the permission is bypassed. The EPSS score of less than 1% suggests a low probability of public exploitation, and it is not listed in the CISA KEV catalog. Because the bypass does not require user interaction, the attack can be carried out simply by executing malicious code on the infected device, leveraging the logic error to elevate privileges.