CVE-2026-0107: Android Pixel-family Specific Package Privilege Escalation Vulnerability
Summary
CVE-2026-0107: In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr.c, there is a possible escalation of privileges due to a confused deputy. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2026-03-05. Fixed in Pixel-family specific:2026-03-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The affected package is part of the Android ecosystem, specifically targeting Pixel-family devices. This package is responsible for handling memory requests in the graphics memory controller (gmc). It plays a crucial role in managing memory access and ensuring that applications can efficiently utilize system resources. However, due to a flaw in its implementation, it is vulnerable to privilege escalation, which can compromise the security of the device.
Vulnerability Detail
In the function gmc_ddr_handle_mba_mr_req located in gmc_mba_ddr.c, there exists a vulnerability that allows for a possible escalation of privileges due to a confused deputy scenario. This means that an attacker could exploit this flaw to gain higher access rights on the device without needing additional execution privileges. The exploitation does not require user interaction, making it particularly dangerous as it can be executed silently in the background, potentially leading to unauthorized access to sensitive data or system functions.
How To Fix
Minimum fixed version
Pixel-family specific:2026-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability other than applying the patch as soon as it becomes available.
Conclusion
In summary, CVE-2026-0107 represents a significant security vulnerability in the Android Pixel-family devices that could lead to local privilege escalation. Users are strongly advised to update their devices to the patched version released on March 5, 2026, to protect against potential exploits.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2026-0107 is a vulnerability in the Android Pixel-family devices that allows for local escalation of privileges due to a flaw in the graphics memory controller.
You can check if your application is affected by using the Vulert playground at Vulert Scanner without any signup.
The risks include unauthorized access to sensitive data and system functions, which could lead to data breaches or compromised device integrity.
No, user interaction is not needed for exploitation, making it particularly concerning.
While there are no workarounds, it is crucial to prioritize updating your device as soon as the patch is available to mitigate the risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
