Google Android: Out-of-bounds write enables local privilege escalation
Summary
An out-of-bounds write caused by a missing bounds check affects Android on Pixel devices. A local attacker who already has System-level execution privileges could escalate privileges, and no user interaction is required. The CVE record names the Android kernel as the affected component, while Google's Pixel bulletin lists the subcomponent as CHRE. The CVSS 6.7 score was supplied with the request and could not be verified, as NVD has not analysed the CVE yet.
Affected
- Google Android, Pixel devices (bulletin bug A-508385434, subcomponent CHRE, type EoP, severity High)
- CVE record lists the affected component as the Android kernel; the bulletin lists CHRE
- Exact affected Android builds and Pixel models: Unknown.
Fixed in
- Security patch level 2026-11-05 or later, as stated in the Pixel Update Bulletin of November 2026 and OSV.
Workaround
- No workaround documented in the sources.
- Installing the 2026-11-05 patch level is the only identified fix.
Exploitation
- No exploitation in the wild known.
- CISA SSVC assessment: Exploitation none, Automatable no, Technical Impact total.
- One secondary source states the CVE is not in CISA's KEV catalogue.
- No public proof of concept found.
Our recommendation
- Check the patch level of all Pixel devices in Settings and install the 2026-11-05 update or later.
- Prioritise managed Pixel devices that handle sensitive data.
- Identify Pixel models that no longer receive patches, as they cannot be fixed and should be replaced or restricted.
- Monitor for updates to the NVD entry and the vendor bulletin.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Google Pixel Update Bulletin, November 2026 source.android.com
- CVE Record CVE-2026-58729 www.cve.org
- OSV entry A-508385434 osv.dev
- Strix CVE details (secondary) www.strix.ai
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 11:25.
Original description (NVD)
In multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.