Google Android Pixel Devices Out-of-Bounds Write Vulnerability in TPU Component Allowing Local Privilege Escalation

A vulnerability allowing an out-of-bounds write has been identified in the GetHostAddress function of gxp_buffer.h. This issue arises from a missing bounds check, which could lead to local privilege escalation without requiring additional execution privileges or user interaction. The vulnerability affects Google Pixel devices and is addressed in the December 2025 security patch.

Impact

Exploitation of this vulnerability could lead to unauthorized elevation of privileges, allowing a user to gain access to restricted functions or data.

Remediation

Users can update their devices to the December 2025 security patch level to address this vulnerability.