Google warns that there is a high-risk vulnerability in the firmware of its Pixel smartphones, which may be actively exploited.
The zero-day vulnerability, tracked as CVE-2024-32896, is a privilege escalation issue that could allow attackers to gain elevated system privileges on affected devices.
This disclosure is part of Google's June 2024 security update, which addressed 50 vulnerabilities across various components of the Pixel ecosystem. Among these, five vulnerabilities affected Qualcomm chipsets, while others impacted critical components such as modems, Trust, and ACPM.
Although Google has not shared more details about the attacks exploiting the zero-day vulnerability, the company acknowledges that there are "indications that CVE-2024-32896 may be subject to limited, targeted exploitation."
The vulnerability is located in the Pixel firmware and could allow attackers to elevate their privileges on infected devices, thereby gaining access to sensitive data and system resources. Google has urged Pixel users to promptly apply the June 2024 security update, which addresses the zero-day vulnerability and other reported issues.
The June 2024 update is applicable to a variety of supported Pixel devices, including the 5G-enabled Pixel 5a, Pixel 6a, Pixel 6, Pixel 6 Pro, Pixel 7, Pixel 7 Pro, Pixel 7a, Pixel 8, Pixel 8 Pro, Pixel 8a, and the recently released Pixel Fold.
Users can install the update by navigating to "Settings" > "Security and Privacy" > "System and Updates" > "Security Update", then clicking "Install" and restarting the device.
This is not the first time Google has addressed actively exploited vulnerabilities in its Pixel ecosystem. Earlier in April this year, the tech giant resolved two security vulnerabilities in the bootloader and firmware components (CVE-2024-29745 and CVE-2024-29748), which forensic firms exploited to access sensitive data on Pixel devices without authorization.
Just days before the emergence of the actively exploited zero-day vulnerability in Pixel firmware, leading chip designer Arm had just warned users about a memory-related vulnerability (CVE-2024-4610) in its Bifrost and Valhall GPU core drivers, which was also actively exploited.
