A logic error below Android's reach lets attackers escalate on Pixel handsets without any interaction.