CVE-2025-36934
📋 TL;DR
This CVE describes a use-after-free vulnerability in the bigo_worker_thread function of Google's Android video processing code. It allows local attackers to escalate privileges without user interaction via a race condition. This affects Android devices, particularly Google Pixel phones.
💻 Affected Systems
- Google Pixel phones
- Android devices with affected video processing components
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
Full device compromise with kernel-level access, allowing installation of persistent malware, data theft, and complete control over the device.
Likely Case
Local privilege escalation to root/system privileges, enabling bypass of security controls and installation of malicious applications.
If Mitigated
Limited impact if SELinux policies and other Android security features successfully contain the escalation.
🎯 Exploit Status
Exploitation requires winning a race condition, which adds complexity but is feasible for skilled attackers. No user interaction needed once local access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: December 2025 Android security patch level or later
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2025-12-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install the December 2025 security patch. 3. Reboot the device. 4. Verify the patch level in Settings > About phone > Android version.
🔧 Temporary Workarounds
Disable affected video processing
androidPotentially disable the vulnerable bigo_worker_thread component if not needed
🧯 If You Can't Patch
- Restrict physical access to devices and implement strict app installation policies
- Monitor for suspicious privilege escalation attempts using Android security logging
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If before December 2025, device is likely vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify the security patch level shows 'December 1, 2025' or later in Settings > About phone > Android version.📡 Detection & Monitoring
Log Indicators:
- Kernel panic logs
- SELinux denials related to video processing
- Unexpected privilege escalation in audit logs
Network Indicators:
- None - this is a local exploit
SIEM Query:
Look for process privilege changes from user to root/system without legitimate cause