CVE-2025-36916
📋 TL;DR
This CVE describes a race condition vulnerability in Android's graphics subsystem that allows local privilege escalation without user interaction. Attackers can exploit a double-fetch issue in the PrepareWorkloadBuffers function to gain elevated privileges on affected devices. This primarily affects Android devices, particularly Google Pixel phones.
💻 Affected Systems
- Google Pixel devices
- Android devices with similar GPU drivers
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to execute arbitrary code with kernel privileges, potentially installing persistent malware or accessing all user data.
Likely Case
Local privilege escalation allowing malicious apps to break out of sandbox and access system resources, other apps' data, or install additional payloads.
If Mitigated
Limited impact if devices are fully patched, have SELinux enforcing mode, and app sandboxing is properly configured.
🎯 Exploit Status
Exploitation requires local access and knowledge of race condition timing; no public exploit code available yet
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: December 2025 Android Security Patch or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2025-12-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install December 2025 security patch. 3. Reboot device after installation completes.
🔧 Temporary Workarounds
Restrict app installations
androidOnly install apps from trusted sources like Google Play Store to reduce attack surface
Enable Play Protect
androidEnsure Google Play Protect is active to detect potentially harmful apps
🧯 If You Can't Patch
- Isolate affected devices from sensitive networks and data
- Implement application allowlisting to restrict which apps can run
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version > Security patch levelCheck Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows December 2025 or later date📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- SELinux denials related to gxp_main_actor
- Abnormal privilege escalation attempts
Network Indicators:
- Unusual outbound connections from system processes
SIEM Query:
process:gxp* AND event:privilege_escalation OR process:gxp* AND event:crash