Google Android: 25 Vulnerabilities Disclosed, Enabling Local Privilege Escalation
Google patched 25 Android vulnerabilities on September 15, 2026, including high-severity flaws enabling local privilege escalation.
Key findings
- 25 Android vulnerabilities disclosed on September 15, 2026, ranging from medium to high severity.
- Multiple flaws allow for local privilege escalation with no additional execution privileges needed.
- Key affected components include the SMMU, GPU, and multimedia decoders.
- Memory corruption issues like out-of-bounds reads/writes and use-after-free are prevalent.
- Related reporting suggests limited, targeted exploitation of a similar modem vulnerability.
- Prompt patching is essential for mitigating these risks.
On September 15, 2026, Google disclosed a significant batch of 25 vulnerabilities affecting its Android operating system. These flaws, all patched on the same day, range in severity from medium to high, with several allowing for local privilege escalation. The disclosures highlight ongoing security challenges within complex operating system components.
A notable cluster of vulnerabilities stems from issues within the arm-smmu-v3.c component, including CVE-2026-58767, CVE-2026-58766, CVE-2026-58755, and CVE-2026-58718. These flaws involve logic errors, improper input validation, and race conditions, leading to privilege escalation. Specifically, CVE-2026-58766 and CVE-2026-58755 are rated as high severity.
Memory corruption vulnerabilities are also prevalent in this batch. Several instances of out-of-bounds writes and reads are present, often due to missing bounds checks or race conditions. These include CVE-2026-58773 in link_device.c, CVE-2026-58734 in google_mba_poll.c, CVE-2026-58701 in generic-arm64-smcall.c, CVE-2026-58699 in vp9hwd_output.cc, CVE-2026-57014 in phNxpNciHal_ext.cc, CVE-2026-56997 in vp9hwd_headers.cc, CVE-2026-56989, and CVE-2026-56978 in gc.c. Of particular concern is CVE-2026-56997, a high-severity flaw that could lead to remote privilege escalation.
Other vulnerabilities include use-after-free errors (CVE-2026-58724, CVE-2026-56988), permission bypasses (CVE-2026-58726, CVE-2026-58691, CVE-2026-56992), information disclosure via uninitialized memory use (CVE-2026-58721, CVE-2026-57006), and type confusion issues leading to privilege escalation or signature disclosure (CVE-2026-56986, CVE-2026-56985).
While Google's advisory does not detail specific threat actors or widespread exploitation for this particular batch, related reporting indicates that at least one vulnerability, CVE-2026-58704 (not in this batch but disclosed around the same time), was reportedly under limited, targeted exploitation in the wild, affecting the Pixel Cellular Modem. This underscores the importance of timely patching for Android devices.
The disclosed vulnerabilities affect various components of Android, including the SMMU, GPU, cellular modem, and multimedia decoders. The common thread across many of these flaws is the potential for local privilege escalation, meaning an attacker with initial access to a device could leverage these vulnerabilities to gain higher-level system privileges.
Google has addressed these vulnerabilities through its regular security update process. Users are strongly advised to ensure their Android devices are updated to the latest available security patch to mitigate these risks. The specific versions patched are not detailed in the provided information, but prompt updates are the primary defense.
This coordinated disclosure event highlights the continuous effort required to secure the Android ecosystem. While many of these vulnerabilities require local access, their successful exploitation could lead to significant compromise of user data and device integrity. Users should remain vigilant and apply security updates as soon as they become available.
The batch includes high-severity flaws such as CVE-2026-58699 and CVE-2026-56997, which could lead to privilege escalation with no additional execution privileges needed. Several vulnerabilities, including CVE-2026-58766 and CVE-2026-58755, stem from logic errors in the arm-smmu-v3.c component. Memory corruption, including out-of-bounds reads and writes, is a recurring theme across multiple CVEs in this batch. Exploitation of these vulnerabilities generally requires no user interaction, increasing the potential impact. The disclosures cover a range of Android components, from the SMMU to multimedia decoders. A related vulnerability, CVE-2026-58704, has reportedly seen limited, targeted exploitation in the wild. CVE-2026-58773, CVE-2026-58767, CVE-2026-58766, CVE-2026-58765, CVE-2026-58755, CVE-2026-58734, CVE-2026-58726, CVE-2026-58724, CVE-2026-58721, CVE-2026-58718, CVE-2026-58716, CVE-2026-58701, CVE-2026-58699, CVE-2026-58695, CVE-2026-58691, CVE-2026-57035, CVE-2026-57014, CVE-2026-57006, CVE-2026-56997, CVE-2026-56992, CVE-2026-56989, CVE-2026-56988, CVE-2026-56986, CVE-2026-56985, CVE-2026-56978