CVE-2026-0143: Memory Corruption Vulnerability in Android Pixel Family Devices
Summary
CVE-2026-0143: In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. Affects :unknown: versions >= Pixel-family specific:0, < Pixel-family specific:2026-06-05. Fixed in Pixel-family specific:2026-06-05. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The lwis_event.c file is part of the Android operating system, specifically within the Pixel family of devices. This component is responsible for handling external events related to device operations. The functionality is crucial for ensuring that the device responds appropriately to various triggers and inputs. However, due to a flaw in the code, it is susceptible to a memory corruption issue that can lead to serious security implications.
Vulnerability Detail
In the function lwis_device_external_event_emit of lwis_event.c, a use after free vulnerability exists. This occurs when the program continues to use a pointer after the memory it points to has been freed. This flaw can lead to local escalation of privilege, allowing an attacker to execute code with system-level privileges. The exploitation of this vulnerability does not require user interaction, making it particularly dangerous.
How To Fix
Minimum fixed version
Pixel-family specific:2026-06-05
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds available to mitigate this vulnerability without applying the patch. Users are advised to monitor for updates and apply them as soon as they are available.
Conclusion
CVE-2026-0143 represents a serious memory corruption vulnerability in the lwis_event.c file affecting Android Pixel family devices. Users are strongly encouraged to update their devices to the latest patched version to protect against potential exploitation.
See every vulnerability recorded for :unknown: →
FAQ
CVE-2026-0143 is a vulnerability in the lwis_event.c file of Android Pixel family devices that can lead to memory corruption and local privilege escalation.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The primary risk is local escalation of privilege, which could allow an attacker to execute malicious code with system execution privileges.
No, user interaction is not needed for exploitation, making it a significant security concern.
While there are no specific workarounds, it is crucial to stay informed about updates and apply them as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for :unknown:.
