“After initially rating it as a High-severity vulnerability, the Android security team later decided to reclassify it as a “Won’t fix” and they passed my report to Arm’s security team.”
CVE-2022-38181 lets any Android app get kernel code execution and root on a Pixel 6 through the Arm Mali GPU driver. It was reported on July 12, 2022. Arm shipped a public patch quickly, and Google went quiet, then fixed it in the January Pixel update with no CVE and no bug ID in the bulletin. Google markets the “all Google” phone and still treats a root exploit in its GPU as someone else’s problem.