Google Warns: Android Zero-Day Flaws in Pixel Phones Exploited by Forensic Companies

Google has disclosed that two Android security flaws impacting its Pixel smartphones have been exploited in the wild by forensic firms.

The higher-severity zero-working day vulnerabilities are as follows –

• CVE-2024-29745 – An info disclosure flaw in the bootloader element
• CVE-2024-29748 – A privilege escalation flaw in the firmware element

“There are indications that the [vulnerabilities] may be beneath confined, focused exploitation,” Google explained in an advisory revealed April 2, 2024.

✔ Approved Seller From Our Partners

Protect your privacy by Mullvad VPN. Mullvad VPN is one of the famous brands in the security and privacy world. With Mullvad VPN you will not even be asked for your email address. No log policy, no data from you will be saved. Get your license key now from the official distributor of Mullvad with discount: SerialCart® (Limited Offer).

➤ Get Mullvad VPN with 12% Discount

Though the tech huge did not reveal any other details about the mother nature of the attacks exploiting these shortcomings, the maintainers of GrapheneOS stated they “are becoming actively exploited in the wild by forensic businesses.”

“CVE-2024-29745 refers to a vulnerability in the fastboot firmware employed to help unlocking/flashing/locking,” they claimed in a series of posts on X (previously Twitter).

“Forensic businesses are rebooting units in Immediately after To start with Unlock condition into fastboot method on Pixels and other equipment to exploit vulnerabilities there and then dump memory.”

GrapheneOS mentioned that CVE-2024-29748 could be weaponized by area attackers to interrupt a manufacturing unit reset triggered via the machine admin API.

The disclosure will come extra than two months right after the GrapheneOS staff uncovered that forensic companies are exploiting firmware vulnerabilities that effects Google Pixel and Samsung Galaxy telephones to steal knowledge and spy on end users when the system is not at rest.

It also urged Google to introduce an auto-reboot function to make exploitation of firmware flaws a lot more challenging.

Found this write-up interesting? Observe us on Twitter  and LinkedIn to examine far more special material we submit.