CVE-2025-36936
📋 TL;DR
This vulnerability allows local privilege escalation through an integer overflow in the GetTachyonCommand function, leading to an out-of-bounds write. It affects Android devices, particularly Google Pixel phones, and requires no user interaction for exploitation.
💻 Affected Systems
- Google Pixel phones
- Android devices with Tachyon components
📦 What is this software?
Android by Google
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains root/system privileges on the device, enabling complete control, data theft, persistence, and further network attacks.
Likely Case
Malicious apps or local attackers escalate privileges to install malware, access sensitive data, or bypass security controls.
If Mitigated
With proper patching and app sandboxing, impact is limited to isolated app compromise without system-wide access.
🎯 Exploit Status
Requires local access but no user interaction; integer overflow to out-of-bounds write chain requires specific conditions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: December 2025 Android security patch
Vendor Advisory: https://source.android.com/security/bulletin/pixel/2025-12-01
Restart Required: Yes
Instructions:
1. Check for system updates in Settings > System > System update. 2. Install the December 2025 security patch. 3. Reboot the device.
🔧 Temporary Workarounds
Restrict app installations
androidPrevent installation of untrusted apps that could exploit this vulnerability.
Enable 'Install unknown apps' restriction in Settings > Apps > Special app access
🧯 If You Can't Patch
- Isolate affected devices from critical networks and sensitive data.
- Implement application allowlisting to prevent execution of potentially malicious apps.
🔍 How to Verify
Check if Vulnerable:
Check Android security patch level in Settings > About phone > Android version. If before December 2025, device is vulnerable.Check Version:
adb shell getprop ro.build.version.security_patchVerify Fix Applied:
Verify security patch level shows 'December 1, 2025' or later in Settings > About phone.📡 Detection & Monitoring
Log Indicators:
- Unusual privilege escalation attempts in system logs
- SELinux denials related to Tachyon components
Network Indicators:
- Unusual outbound connections from system processes post-exploitation
SIEM Query:
source="android_system" AND (event="privilege_escalation" OR process="tachyon")