The flaw is a logic error in the Android bootloader that bypasses permission checks, allowing code executing with System privileges to be granted without proper authorization. If an attacker can trigger this code path, they can obtain full root access on a device. The vulnerability is exploited locally and requires no user interaction, meaning any user with access to the device could potentially exploit the flaw.

Google Android devices as listed in the 2026 September security bulletin. The threat covers Pixel phones and any other devices running the vulnerable bootloader. Exact version ranges are not disclosed, so every device that has not yet received the vendor’s patch is potentially affected.

The logic error allows local attackers with physical or local device access to exploit the flaw without user interaction, granting System privileges that effectively elevate privileges to root. Because the EPSS score is < 1% and KEV does not list this vulnerability, no public exploitation has been reported yet, but the local nature and lack of barriers make the risk to confidentiality, integrity, and availability high.