CVE-2026-0150: In ExecuteGraph command handler of EdgeTPU firmware, there is a possible out of bounds write due to an integer overflow

Synopsis

An integer overflow leading to an out-of-bounds write exists in the ExecuteGraph command handler of the EdgeTPU firmware component within the Android kernel. The flaw is reachable locally by an attacker who already has a low-privilege shell or process on the device, and no user interaction is required. Successful exploitation allows the attacker to escalate privileges to root, gaining full read, write, and execution control over the affected system. No upstream fix has been published yet; HarborGuard tracks the advisory and will make a patched-image rebuild available as soon as Google releases one.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the vulnerable component is required.

• AuthenticationRequired

  Any low-privilege account on the device is sufficient; the attacker does not need administrative or root credentials to reach the vulnerable code path.

• Victim interactionNot required

  No user interaction of any kind is needed; the attacker can trigger the overflow entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special race-condition timing, memory-layout guessing, or other environmental preconditions.

Blast Radius

• A successful attacker escalates from a low-privilege process to root, gaining unrestricted control over the device.
• With root access, the attacker reads any file or memory region on the system, including credentials, keys, and sensitive application data.
• The attacker writes to or modifies any file, kernel structure, or persisted data on the device, including security-critical system files.
• The attacker can crash, restart, or permanently disable system services and the device itself.