CVE-2025-36934: Google Android Privilege Escalation Flaw

CVE-2025-36934 Overview

CVE-2025-36934 is a use-after-free vulnerability in the bigo_worker_thread function of the Android kernel video driver located at private/google-modules/video/gchips/bigo.c. The flaw stems from a race condition [CWE-362] in the BIGO video codec driver used by Google Pixel devices. A local attacker can trigger the race to gain elevated kernel privileges without user interaction or additional execution rights. Google addressed the issue in the December 2025 Pixel security bulletin.

Critical Impact
Local privilege escalation to kernel context on affected Android devices, enabling full compromise of the device without user interaction.

Affected Products

Google Android (Pixel devices using the BIGO video codec kernel module)
private/google-modules/video/gchips/bigo.c kernel component
Devices prior to the December 2025 Pixel security patch level

Discovery Timeline

2025-12-01 - Google publishes fix in the December 2025 Pixel Security Bulletin
2025-12-11 - CVE-2025-36934 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36934

Vulnerability Analysis

The vulnerability resides in bigo_worker_thread, the kernel worker routine of the BIGO video accelerator driver shipped in Google Pixel devices. The driver coordinates video codec workloads through a worker thread that processes queued requests from user space. A race condition between the worker thread and a concurrent path allows an object to be freed while still referenced, resulting in a use-after-free condition.

Exploitation occurs entirely from a local, low-privileged context. An attacker with the ability to open the BIGO device node and submit codec work items can race the worker thread to dereference freed kernel memory. Successful exploitation leads to kernel memory corruption and arbitrary code execution at kernel privilege.

Root Cause

The root cause is improper synchronization between bigo_worker_thread and code paths that release driver objects. Object lifetime is not protected by adequate locking or reference counting. When the worker thread accesses a structure after it has been freed by a concurrent context, the resulting dangling pointer dereference corrupts kernel memory.

Attack Vector

The attack vector is local. A malicious application installed on the device, or code running in a compromised app sandbox, can interact with the BIGO driver interface to trigger the race. No additional execution privileges are required, and the user does not need to interact with the application. Reliable exploitation requires winning a timing window, which raises attack complexity but does not prevent weaponization.

No public proof-of-concept code is available. Refer to the Android Security Bulletin December 2025 and Project Zero Issue #426567975 for technical details.

Detection Methods for CVE-2025-36934

Indicators of Compromise

Unexpected kernel panics or crash logs referencing bigo_worker_thread or the BIGO codec driver
Applications repeatedly opening /dev/bigo or related video accelerator device nodes outside of normal media playback
Anomalous codec worker activity logged by dmesg or Android logcat under the BIGO module

Detection Strategies

Monitor kernel logs for KASAN, slab corruption, or use-after-free reports tied to the BIGO driver
Inspect process behavior for non-media applications issuing ioctl calls against the video codec device
Use Android Verified Boot and dm-verity to identify unexpected modifications to kernel modules

Monitoring Recommendations

Centralize Android crash and tombstone reports for kernel-level anomalies across the fleet
Track Pixel security patch level (ro.build.version.security_patch) and flag devices below 2025-12-01
Alert on processes attempting privilege escalation following access to GPU or video codec device nodes

How to Mitigate CVE-2025-36934

Immediate Actions Required

Apply the December 2025 Pixel security patch level (2025-12-01 or later) to all affected Pixel devices
Inventory managed Android devices and prioritize patching those running the BIGO codec module
Restrict installation of untrusted applications through enterprise mobility management policies

Patch Information

Google released the fix in the Android Security Bulletin December 2025 for Pixel devices. Patched builds enforce proper synchronization in bigo_worker_thread to eliminate the race condition. Verify the patch level on a device with getprop ro.build.version.security_patch.

Workarounds

No vendor-supplied workaround exists; patching is the only complete remediation
Limit deployment of untrusted third-party applications until the patch is applied
Enforce Google Play Protect and restrict sideloading on managed devices to reduce the local attacker surface

bash

# Verify the device security patch level on Android
adb shell getprop ro.build.version.security_patch
# Expected output for patched devices: 2025-12-01 or later