CVE-2026-0108: PowerVR GPU Register Protection Misconfiguration Leading to Local Information Disclosure
Summary
CVE-2026-0108: The register protection of the PowerVR GPU is incorrectly configured. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2026-03-05. Fixed in Pixel-family specific:2026-03-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The PowerVR GPU is a graphics processing unit widely used in various Android devices, particularly in the Pixel family. It is designed to handle complex graphics rendering tasks efficiently, enabling high-performance gaming and multimedia experiences. However, a misconfiguration in the register protection of the PowerVR GPU has been identified, which could expose sensitive information to local users.
Vulnerability Detail
The vulnerability arises from an incorrect configuration of the register protection in the PowerVR GPU. This flaw allows local information disclosure without requiring any additional execution privileges or user interaction for exploitation. As a result, malicious users with access to the device could potentially exploit this vulnerability to gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
Pixel-family specific:2026-03-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available for this vulnerability. The best course of action is to apply the available patch as soon as it is released.
Conclusion
CVE-2026-0108 represents a significant vulnerability in the PowerVR GPU's register protection configuration, allowing for local information disclosure. Users are urged to update their devices to the patched version as soon as it becomes available to mitigate potential risks.
See every vulnerability recorded for :unknown: →
FAQ
The vulnerability primarily affects devices in the Pixel family that utilize the PowerVR GPU.
No, user interaction is not needed for exploitation, making it a significant security concern.
The vulnerability could lead to the disclosure of sensitive local information, potentially compromising user privacy.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without any signup.
While there are no specific workarounds, it is recommended to monitor your device for updates and apply them as soon as possible.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
