CVE-2026-0187: Android Image Auth Service Privilege Escalation

CVE-2026-0187 Overview

CVE-2026-0187 is a local privilege escalation vulnerability in the gsa_sw_pk_hash_compare function of image-auth-srv.c. A logic error in the code allows an attacker with existing high-privileged access to escalate privileges to System-level execution. Exploitation does not require user interaction. The flaw is classified under [CWE-693] (Protection Mechanism Failure), indicating that a security control fails to operate as intended. The vulnerability was published in the Android Security Bulletin covering Pixel devices in September 2026.

Critical Impact
Successful exploitation grants System execution privileges on the affected device, bypassing image authentication protections without any user interaction.

Affected Products

Android / Pixel devices referenced in the September 2026 Android Security Bulletin
Components implementing image-auth-srv.c image authentication service
Devices relying on gsa_sw_pk_hash_compare for public key hash validation

Discovery Timeline

2026-09-15 - CVE-2026-0187 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-0187

Vulnerability Analysis

The vulnerability resides in gsa_sw_pk_hash_compare, a routine in image-auth-srv.c responsible for comparing public key hashes during image authentication. A logic error in the comparison flow undermines the protection mechanism the function is meant to enforce. Because image authentication gates trust boundaries on the device, a defect in this check translates directly into a privilege boundary violation.

An attacker who can already invoke the image authentication service can trigger the flawed comparison path to gain System execution privileges. The attack vector is local, exploitation complexity is low, and no user interaction is required. The confidentiality, integrity, and availability impacts on the affected component are all high.

Root Cause

The root cause is a logic error in the public key hash comparison performed by gsa_sw_pk_hash_compare. Instead of enforcing strict equality between the expected and provided hash values under all input conditions, the function follows a code path that allows the check to succeed when it should fail. This maps to [CWE-693] because the intended protection mechanism, cryptographic image authentication, does not function correctly.

Attack Vector

An attacker with high privileges on the local device supplies crafted input to the image authentication service. The service reaches gsa_sw_pk_hash_compare, the flawed comparison returns success on data that should be rejected, and downstream code treats an unauthorized image as authenticated. Execution continues in a System context, giving the attacker elevated privileges. See the Android Security Bulletin September 2026 for vendor-supplied technical details.

No public proof-of-concept exploit is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-0187

Indicators of Compromise

Unexpected invocations of the image authentication service (image-auth-srv) from non-standard callers on the device.
Processes running with System privileges that were not spawned by the normal Android init or system_server chain.
Load events for images or firmware components whose public key hashes do not match the vendor-signed reference set.

Detection Strategies

Monitor calls into gsa_sw_pk_hash_compare and correlate with the calling process context to spot anomalous high-privileged callers.
Baseline the expected set of authenticated images on Pixel devices and alert on new or modified images that still pass authentication.
Review Android security logs for privilege transitions to the System UID that originate from user-installed or debug components.

Monitoring Recommendations

Ingest Android device logs and audit events into a centralized analytics platform to correlate privilege escalations across the fleet.
Track patch level compliance against the September 2026 Android Security Bulletin and alert on devices that fall behind.
Watch for repeated image authentication failures followed by a successful authentication, which may indicate exploitation attempts.

How to Mitigate CVE-2026-0187

Immediate Actions Required

Apply the September 2026 Pixel security patch to all affected devices as the authoritative fix.
Enforce mobile device management (MDM) policies that block enrollment or corporate access for devices below the September 2026 patch level.
Restrict installation of untrusted applications on affected devices to reduce the pool of local actors that could reach the vulnerable service.

Patch Information

Google addressed CVE-2026-0187 in the September 2026 Pixel security bulletin. Refer to the Android Security Bulletin September 2026 for the patched build identifiers and detailed component fixes. Devices should be updated to the 2026-09-01 or later security patch level.

Workarounds

No vendor-supplied workaround is available; patching is the only reliable remediation.
Limit high-privilege access on affected devices to reduce the attack surface until the patch is applied.
Disable or restrict developer options and USB debugging on production devices to reduce local attack opportunities.

bash

# Verify the Android security patch level on an affected device
adb shell getprop ro.build.version.security_patch
# Expected output for remediated devices: 2026-09-01 or later