Reading time: 2 minutes.
Recently, Google has released a monthly update for Pixel devices, highlighting a serious vulnerability, called CVE-2024-32896, which may be under targeted exploitation putting the US Government on notice. This vulnerability zero-daydiscovered without the manufacturer’s knowledge and without a fix available at the time of discovery, has been classified as “High Severity”.
Reaction from the United States Government
According to Forbes, this vulnerability alarmed the US government, so much so that it ordered all federal employees with a Pixel device to update their phones by July 4th or stop using them. This warning, while directed at US government agencies, is also relevant to businesses and individuals using corporate Wi-Fi networks, who should install the latest security update as soon as possible.
Vulnerability Details
The list of Known Exploited Vulnerabilities (KEV) maintained by CISA (Cybersecurity and Infrastructure Security Agency) reported that “Android Pixel contains an unspecified vulnerability in the firmware that allows for escalation of privilege.” This would allow an attacker to use an app to capture information that would not normally be available.
Security Update
Even though the US government seems to be focusing on Pixel users, GrapheneOS stressed that the vulnerability does not only affect these devices. The vulnerability was fixed on Pixels with the June update (Android 14 QPR3) and will be fixed on other Android devices with the update to Android 15. If the devices are not updated to Android 15they probably won’t get the fix, since it hasn’t been retroported.
How to Update Your Pixel Device
To update your Pixel device, go to
Settings > System > Software Updates
and, if you have a pending update, follow the instructions. It is recommended that all Pixel users, discover on Amazonwhether they work for the US government or not, update their phones immediately.
