CVE-2026-0126 is a critical (CVSS 9.8) out-of-bounds write in the WC-Radio component, listed in the June 2026 Pixel Update Bulletin. It could lead to remote code execution with no user interaction. Google says security patch level 2026-06-05 or later addresses it, so update supported Pixel devices.
What's affected
The record lists Google Android. The Pixel Update Bulletin for June 2026 lists CVE-2026-0126 as a critical remote code execution issue in WC-Radio. Google says patch levels of 2026-06-05 or later address all issues in that bulletin.
Affected device models are not listed in the record, so check the bulletin for the devices it covers.
How to check if you're exposed
On a device, open Settings, then About phone, then Android version, and read the Android security patch level. A date of 2026-06-05 or later includes the fix. For managed fleets, query the patch level in your mobile device management console and list devices that fall behind.
What to do now
- Check the patch level on every managed Pixel device.
- Install the June 2026 update, or any later one, on devices below 2026-06-05.
- For fleets, set a compliance rule that flags devices with a patch level older than your target.
- Remove devices that no longer receive updates from sensitive use.
- Review the full bulletin, since other critical items were fixed in the same release.
For individual users, the fix is simply to accept the update. For organisations, the harder part is the fleet. Use your mobile device management console to report patch levels and to set a compliance rule with a minimum date. Devices that fall behind can then be flagged or blocked from company resources until they update.
Radio and modem components are hard to protect by configuration, because they sit below the operating system. That is why the patch level is the main control. Keep a policy for devices that stop receiving updates, and retire them from sensitive use.
The June bulletin lists several other critical items in the same release, so the update has value beyond this one CVE.
Why it matters
The weakness classes are CWE-120 (classic buffer overflow) and CWE-787 (out-of-bounds write). The bulletin says a missing bounds check allows the write. Radio components handle data from outside the device, which is why the vector shows network access, no privileges and no user interaction.
The record does not mark this as exploited, and it is not in the CISA KEV list. Google rates it Critical.
Quick check
How do I know a Pixel is fixed?
Its security patch level reads 2026-06-05 or later, according to the bulletin.
If you want a quick look at your own dependencies, the free in-browser scan at gold.safeguard.sh/scan needs no repository access.
Sources
Fetched for this guide:
Last reviewed: 19 October 2026.
