Google Pixel owners have another reason to check their phones for an update.
Google’s August 2026 Pixel security update patches a high-severity vulnerability that could allow an attacker to elevate privileges on affected devices. The update also incorporates the security fixes included in Google’s broader August Android security release.
According to Google’s August Pixel Update Bulletin, all supported Google devices will receive the Aug. 5, 2026 security patch level. For supported Google devices, that patch level addresses the Pixel-specific vulnerability as well as all issues included in the August Android Security Bulletin.
Pixel flaw could allow privilege escalation
The Pixel-specific vulnerability is tracked as CVE-2026-0163 and affects the device’s Video Processing Unit.
Google classifies the flaw as a high-severity elevation-of-privilege vulnerability. The company’s bulletin does not provide public technical details on how the vulnerability could be exploited, and the associated Android bug is marked private.
Elevation-of-privilege vulnerabilities can allow an attacker with some level of access to a device to gain permissions that would normally be restricted. The exact impact depends on the vulnerable component and the conditions required for exploitation.
Google’s bulletin does not say CVE-2026-0163 is being actively exploited in the wild.
Google previously patched an Android zero-day vulnerability that was under active exploitation, allowing privilege escalation on affected devices, while another Android vulnerability disclosed this year posed a zero-click remote code execution risk.
The latest Pixel issue is rated high severity, but Google has not issued a comparable warning that attackers are exploiting it in the wild.
August update includes broader Android security fixes
Pixel owners are also receiving the protections included in the August 2026 Android Security Bulletin.
For supported Google devices, the Aug. 5, 2026 security patch level or later addresses all issues covered by both Google’s Pixel bulletin and the August Android Security Bulletin.
The update arrives as mobile devices remain an important target for attackers. Browser vulnerabilities can also add another attack path, including the two Chrome zero-days that Google patched earlier this year.
Pixel owners should check their security patch level
Pixel owners should install the August security update as soon as it becomes available for their device.
Users can check their Android security patch level through their phone’s settings and confirm that it shows Aug. 5, 2026 or later. Google says all supported devices will receive the updated patch level and encourages customers to accept it.
For organizations managing Pixel phones, security teams should verify patch compliance through MDM or UEM and enforce minimum security patch levels. Devices that remain unpatched should be restricted from accessing sensitive corporate resources until they are compliant.
Google has not reported active exploitation of CVE-2026-0163, but organizations should not delay remediation. Public disclosure provides attackers with information they can use to target unpatched devices.
Related reading: For another Google-related security threat, see how a fake voicemail phishing campaign is targeting users to steal Google credentials.