GoogleCVE-2026-58699
Google Android: out-of-bounds read
High8.4CVE-2026-58699 · Published Sep 15, 2026 · updated Sep 18, 2026
In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Android Product | <= Android kernel | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- CISA (its enrichment of the CVE record)
- Weakness
- CWE-125
More Google advisories
All Google| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 15 | Google Chrome: race condition | High8.3 | 153.0.8010.47 |
| Sep 15 | Google Chrome: race condition | Medium5.3 | 153.0.8010.47 |
| Sep 15 | Google Chrome: use after free | High8.8 | 153.0.8010.47 |
| Sep 15 | Google Chrome: integer overflow | Medium4.3 | 153.0.8010.47 |
| Sep 15 | Google Chrome: use after free | Low3.1 | 153.0.8010.47 |
| Sep 15 | Google Chrome: race condition | High8.3 | 153.0.8010.47 |