Google has fixed two Google Pixel zero-days exploited by forensic firms to unlock phones without a PIN and gain access to the data stored within them. Although Pixels run Android, they receive separate updates from the standard monthly patches distributed to all Android device OEMs. This is due to their unique hardware platform, over which Google has direct control, and the exclusive features and capabilities. While the April 2024 security bulletin for Android didn't contain anything severe, the corresponding April 2024 bulletin for Pixel devices disclosed active exploitation of two vulnerabilities tracked as CVE-2024-29745 and CVE-2024-29748 flaws. "There are indications that the following may be under limited, targeted exploitation," warned Google. CVE-2024-29745 is marked as a high-severity information disclosure flaw in the Pixel's bootloader, while CVE-2024-29748 is described as a high-severity elevation of privilege bug in the Pixel firmware. Security researchers for GrapheneOS, a privacy-enhanced and security-focused Android distribution, disclosed on X that they discovered forensic companies actively exploited the flaws. The flaws allow companies to unlock and access memory on Google Pixel devices, which they have physical access to.
GrapheneOS discovered and reported these flaws a few months back, sharing some information publicly but keeping the specifics undisclosed to avoid fueling widespread exploitation when a patch wasn't available yet. "CVE-2024-29745 refers...