CVE-2026-0170

CVE-2026-0170 is a missing bounds check in Vp9DecodeFrameTag of vp9hwd_headers.cc, part of the VP9 video decoding path assigned by Google's device security team, resulting in an out-of-bounds write (CWE-787) when the decoder parses a malformed VP9 frame tag. An attacker triggers the flaw remotely by delivering a crafted VP9/WebM video stream to a device or application that routes it through the vulnerable component; CVSS 3.1 is 8.8 (AV:N/AC:L/PR:L/UI:N) meaning an attacker needs only app-level context, not user interaction. Successful exploitation gives remote escalation of privilege with high confidentiality, integrity, and availability impact — effectively code execution beyond the decoder's intended privileges. The advisory does not specify exact product or version ranges, so any Android platform or Google software build shipping the vulnerable vp9hwd_headers.cc code should be considered potentially affected. No public proof-of-concept is known and the issue is not in CISA's KEV catalog, so exploitation status is currently unknown/none observed.

What to do: Apply the Android security update containing the fix for CVE-2026-0170 as soon as your OEM or carrier releases it, and prioritize devices that regularly play media from messaging apps or browsers. Until patched, avoid playing VP9/WebM content from untrusted sources and consider browsers that sandbox media parsing. Device vendors and integrators should backport the bounds-check fix in Vp9DecodeFrameTag and audit their VP9 header-parsing code for similar memory-safety gaps.