CVE-2026-95404: Android/:unknown: vulnerability

Q: Who is exposed to this issue?

Android systems with the affected insecure default configuration are exposed. Exploitation is local and requires System execution privileges; no user interaction is required.

Q: What access does an attacker need?

An attacker needs System execution privileges on the device. The issue could then allow modification of coprocessor instruction and data memory from non-secure software, potentially resulting in local privilege escalation.

Q: Is the default configuration affected?

Yes. The issue is caused by an insecure default value, so deployments using that default may be affected.

Published Nov 1, 2026

Updated

In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure software due to an insecure default value. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

Affected Software

1 affected componentFixes available

android/:unknown:>=Pixel-family specific:0<Pixel-family specific:2026-11-05

Pixel-family specific:2026-11-05

Event History

Nov 1, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Android systems with the affected insecure default configuration are exposed. Exploitation is local and requires System execution privileges; no user interaction is required.

What access does an attacker need?

An attacker needs System execution privileges on the device. The issue could then allow modification of coprocessor instruction and data memory from non-secure software, potentially resulting in local privilege escalation.

Is the default configuration affected?

Yes. The issue is caused by an insecure default value, so deployments using that default may be affected.

CVE-2026-95404: Android/:unknown: vulnerability

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need?

Is the default configuration affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What access does an attacker need?

Is the default configuration affected?