In gmc_ddr_handle_mba_mr_req of gmc_mba_ddr

CVE-2026-0107 is a local elevation-of-privilege bug in the Pixel-side CPM component, described as a confused-deputy flaw in gmc_ddr_handle_mba_mr_req within gmc_mba_ddr.c. Google lists it in the Pixel Update Bulletin—March 2026 as a High severity EoP issue, and devices with a 2026-03-05 or later security patch level are stated to address the bulletin issues. The affected range is therefore best understood as supported Google Pixel devices missing the March 5, 2026 patch level, not the whole internet and not every Android build.

Vendor HIGH 8.4 is technically defensible in a lab because successful exploitation could hand over high confidentiality, integrity, and availability impact on the device. In enterprise reality, though, the decisive friction is attacker position: this is AV:L and effectively requires code running on the handset first. That makes it a post-initial-access privilege escalator for a subset of Android fleets, so it deserves attention but not the same urgency as remotely reachable mobile RCEs or browser/BBU/baseband bugs with exploitation evidence.

Why this verdict

• Start at vendor 8.4, then cut for attacker position: AV:L means this is not an initial-access bug; the attacker must already have code on the device.
• Population narrows again: Google lists the issue in the Pixel bulletin under CPM, so this is not a generic all-Android internet problem.
• No exploitation pressure: no KEV listing, no public exploitation evidence surfaced, and the supplied EPSS 0.00008 is extremely low.

Why not higher?

It is not higher because this is not remotely reachable and it does not create a fleet-wide worm path. Every real attack chain must first solve app delivery, sideloading, physical access, or some other local foothold problem before this CVE matters.

Why not lower?

It is not lower because once the attacker is on the device, the vulnerability can materially increase control and defeat the normal app sandbox boundary. For enterprises with managed Pixel fleets, local EoP bugs still matter because they turn a modest handset foothold into access to enterprise tokens, messages, VPN clients, and sensitive mobile data.

1. Query mobile patch posture — Use your EMM/MDM to identify Pixel devices below 2026-03-05 SPL and map them to corporate-owned, BYOD, and high-risk user groups. Because this is a MEDIUM verdict, there is no mitigation SLA — go straight to the 365-day remediation window, but you should still inventory exposure immediately.
2. Restrict app sources — Enforce managed Google Play, block unknown sources where policy allows, and tighten app allowlisting for privileged or regulated user populations. This directly attacks the main prerequisite — getting local code onto the handset — and should be maintained while devices move through normal update cadence.
3. Disable developer-risk settings — Use mobile policy to limit adb, developer options, and USB debugging except for approved engineering populations. That removes one of the easiest operator-assisted paths to local exploitation and should stay in place through the remediation window.
4. Use device trust in conditional access — Gate access to sensitive SaaS, VPN, and admin apps on mobile compliance signals such as patch level, Play Protect state, and management status. This reduces downstream blast radius if a handset is locally compromised before remediation is complete.
5. Prioritize risky cohorts first — Patch executive, admin, developer, travel, and high-value target groups first inside your normal mobile OS rollout. Even without a mitigation SLA for MEDIUM, those users carry disproportionate credential and data value during the 365-day remediation window.

Run this from an auditor workstation with adb installed and USB or managed debugging access to the target Android/Pixel device. Invoke it as ./check_cve_2026_0107.sh SERIAL123 or omit the serial if only one device is connected; it needs no root, but it does need permission to use adb shell getprop against the handset.

#!/usr/bin/env bash
# check_cve_2026_0107.sh
# Verify likely exposure to CVE-2026-0107 on Android/Pixel devices.
# Logic: Google states Pixel devices with security patch level 2026-03-05 or later
# address the March 2026 Pixel bulletin issues. This script checks that SPL.
# Output: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=usage/dependency error

set -euo pipefail

REQ_SPL="2026-03-05"
SERIAL="${1:-}"

fail() {
  echo "UNKNOWN: $1"
  exit 2
}

need_cmd() {
  command -v "$1" >/dev/null 2>&1 || {
    echo "UNKNOWN: missing dependency '$1'" >&2
    exit 3
  }
}

need_cmd adb
need_cmd awk
need_cmd sed

ADB=(adb)
if [[ -n "$SERIAL" ]]; then
  ADB+=( -s "$SERIAL" )
fi

# Ensure device is reachable
STATE="$(${ADB[@]} get-state 2>/dev/null || true)"
if [[ "$STATE" != "device" ]]; then
  fail "adb target not reachable or not in 'device' state"
fi

getprop_safe() {
  local key="$1"
  ${ADB[@]} shell getprop "$key" 2>/dev/null | tr -d '\r'
}

MANUFACTURER="$(getprop_safe ro.product.manufacturer | sed 's/^ *//;s/ *$//')"
BRAND="$(getprop_safe ro.product.brand | sed 's/^ *//;s/ *$//')"
MODEL="$(getprop_safe ro.product.model | sed 's/^ *//;s/ *$//')"
SPL="$(getprop_safe ro.build.version.security_patch | sed 's/^ *//;s/ *$//')"
FINGERPRINT="$(getprop_safe ro.build.fingerprint | sed 's/^ *//;s/ *$//')"

if [[ -z "$SPL" ]]; then
  fail "security patch level not available from device properties"
fi

# Validate date format YYYY-MM-DD
if ! [[ "$SPL" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then
  fail "unexpected SPL format: '$SPL'"
fi

# Compare ISO dates lexicographically; safe for YYYY-MM-DD
if [[ "$SPL" < "$REQ_SPL" ]]; then
  echo "VULNERABLE: model='$MODEL' manufacturer='$MANUFACTURER' brand='$BRAND' spl='$SPL' required>='$REQ_SPL'"
  echo "DETAIL: fingerprint='$FINGERPRINT'"
  exit 1
else
  echo "PATCHED: model='$MODEL' manufacturer='$MANUFACTURER' brand='$BRAND' spl='$SPL' required>='$REQ_SPL'"
  echo "DETAIL: fingerprint='$FINGERPRINT'"
  exit 0
fi

Sources

1. Google Pixel Update Bulletin — March 2026
2. Android Security Bulletin — March 2026
3. CISA Known Exploited Vulnerabilities Catalog
4. CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
5. Google Help: Check & update your Android version
6. CVE Record — CVE-2026-0107
7. OpenCVE mirror for CVE-2026-0107 metadata
8. Google Android Enterprise device trust signals