The August Pixel update closes a video-chip hole. Take the 5 August patch

Google’s August Pixel bulletin adds a High bug in the video chip’s driver. A use-after-free: the phone frees a piece of memory and code can still touch it. Google says it can lead to remote privilege escalation, and that you do not have to tap anything. Open Settings, System update. You want the 5 August 2026 patch.

Overview

What broke

The Pixel Update Bulletin for August 2026 was published on 4 August. It lists CVE-2026-0163 under Pixel, type elevation of privilege, severity High, subcomponent Video Processing Unit. Google’s words on the CVE: in multiple functions of vpu_ioctl.c there is a possible use-after-free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In English, the video chip has a driver. The driver talks to the rest of the phone through ioctl calls, the small “do this to the device” messages. A use-after-free means the driver hands a chunk of memory back to the system and then uses it anyway. Whatever landed in that chunk next, including an attacker’s data, gets treated as if it still belonged to the driver. Privilege escalation means the result is more power than the caller started with. Remote, and no extra tap, is the part that takes this out of “I’ll update later.”

The Pixel bulletin table is short this month. One Pixel-only row sits on top of the August Android Security Bulletin. Google says security patch levels of 2026-08-05 or later address all issues in this Pixel bulletin and all issues in the August Android bulletin. All supported Google devices receive the 2026-08-05 patch level. Google has not said 0163 is in the wild. CISA has not listed it on KEV.

Who is in range

Supported Pixel phones and tablets that have not reached security patch level 2026-08-05. If Software update offers nothing, read the patch date under About phone. A July date means you are still open. A Pixel that no longer appears on Google’s supported list will not see 2026-08-05. That is a replacement, not a hidden toggle. This brief does not claim any specific older Pixel was dropped. The About date is the proof for the device in your hand.

Galaxy, iPhone, and other Android brands are a different updater. A Galaxy uses Samsung’s SMR and will never show this Pixel bulletin. Carrier-branded Pixels can lag a day or two behind the unlocked ones. The other Pixel in the house is its own tap.

What the vendor shipped

• Bulletin published 4 August 2026
• Patch level 2026-08-05 covers this Pixel issue and the August Android bulletin
• All supported Google devices receive 2026-08-05
• Settings, System, System update (on some builds the first-page name is Software updates)

After the install, Settings, About phone, Android version, Android security update should read 5 August 2026 or later. That date is the close. The build number under it will vary by model. Trust the date.

What this is not

• Not a Samsung SMR. A Galaxy owner wants the Galaxy brief. This driver fix is in the Pixel bulletin.
• Not claimed in the wild. Google did not say 0163 is being used. It is not on KEV.
• Not proven patched just because System update says you are up to date. Read the About date. A July date is still July.
• Not a claim that Pixel 6 or Pixel 7 were dropped. If the device is still on Google’s supported list, it should see 2026-08-05. If the updater offers nothing, the About date is the answer.

The OTA has been rolling since 4 August. Take it this week. That is the cheap window.

Who can skip

• About phone already shows Android security update 5 August 2026 or later.
• iPhone, skip. Galaxy, use the Samsung brief. This driver fix is in the Pixel bulletin.
• A Pixel that no longer appears on Google’s supported list will not see 2026-08-05. That is a replacement, not a hidden toggle.

Why it matters

Privilege escalation on the video path is how a bad app, or a remote trigger Google described, becomes the phone. The Video Processing Unit is not a decoration. It handles the camera preview, the video you play, the call tile. A driver hole at that layer sits under the apps you think of as “the phone.”

“User interaction is not needed” is the line that takes this out of later. You do not have to tap a dialog. You do not have to open a file. Google did not claim victims. CISA has not listed 0163 on KEV. The honest status is the same shape as the other briefs this week: the hole is public, the patch is rolling, waiting is how a High EoP sits on a supported Pixel through another weekend.

The August Android bulletin rides in the same 5 August patch level. You are not doing Google a favor. You are taking the Pixel-only row and the platform row in one restart. That is the point of 2026-08-05. A household with two Pixels and a Galaxy has two System update taps and one Samsung Software update tap. Mixing them up is how the Galaxy stays on July.

The bottom line

Install

1. Unlock the Pixel. Join the Wi-Fi you already trust. Plug it in. Do not start this on 12 percent battery.
2. Open Settings.
3. Tap System. On many Pixels that row sits near the bottom of the first Settings page. Then tap System update. On a few builds the entry is named Software updates and sits on the first Settings page, no System hop.
4. Tap Check for update. If a build appears, tap Download and install. Stay on Wi-Fi. Let the bar finish.
5. When the phone asks to restart, let it. Do not yank the cable. Do not hold Power to force anything. The installer will come back on its own.

Confirm

1. Open Settings, About phone.
2. Tap Android version. Some builds show the security update on the About page itself. Either path is fine.
3. Read Android security update. The date should be 5 August 2026 or later. That is patch level 2026-08-05.
4. If the date is still July, you are not done. System update saying “up to date” with a July date means the OTA has not landed for this unit yet.

If Check for update says you are current and the date is July

Try again tomorrow on Wi-Fi. Carrier-branded Pixels can lag a day or two. Reboot once and check again. Do not flash a factory image from a forum thread unless you already live that life. For everyone else, the OTA is the path. Keep checking this week on the same Wi-Fi. The About date is the only close. A factory image is a last resort for people who already unlock bootloaders, not a home path. If the phone is a work Pixel, the shop’s MDM may delay the OTA. Ask whoever owns the device to allow 2026-08-05, then confirm About yourself.

The other device

1. A second Pixel in the house: same Settings path, same 5 August date.
2. A Pixel tablet: Settings, System, System update, same confirmation.
3. A Galaxy will never show this Pixel bulletin. Use Samsung’s Software update and look for SMR Aug-2026 Release 1 on that phone.
4. iPhone is a different store and a different brief.

What you should see

About phone lists the model, the Android version, and the security update date. The Android version may still say 16. An SMR-style name will not appear. Pixel does not use Samsung’s SMR line. The date is the close: 5 August 2026. Some builds write it as August 5, 2026. Same day. If you see 1 August 2026 only, read it twice. The Pixel bulletin’s patch level is 2026-08-05. Google’s own note says 2026-08-05 or later covers this bulletin and the August Android bulletin. A 1 August date is not that level. Stay on System update until About shows the fifth.

When you are done

About phone shows Android security update 5 August 2026 or later. That is the job. You do not need to reset the Pixel or revoke app passwords for this close. You needed the 5 August patch on this Pixel. You have it.