Security News > 2024 > June > Google warns of actively exploited Pixel firmware zero-day
Google has released patches for 50 security vulnerabilities impacting its Pixel devices and warned that one of them had already been exploited in targeted attacks as a zero-day.
Google tagged 44 other security bugs in this month's Pixel update bulletin, seven of which are privilege escalation vulnerabilities considered critical and impact various subcomponents.
While Pixel devices also run Android, they receive separate security and bug fix updates from the standard monthly patches distributed to all Android OEMs because of their exclusive features and capabilities and the unique hardware platform directly controlled by Google.
In April, Google fixed two other Pixel zero-days exploited by forensic firms to unlock phones without a PIN and access the data.
CVE-2024-29745 was tagged as a high-severity information disclosure bug in the Pixel bootloader, while CVE-2024-29748 is a high-severity privilege escalation bug in the Pixel firmware.
Google fixes fifth Chrome zero-day exploited in attacks this year.
News URL
Related news
- Google fixes Android kernel zero-day exploited in targeted attacks (source)
- Google to Remove App that Made Google Pixel Devices Vulnerable to Attacks (source)
- Google fixes ninth Chrome zero-day exploited in attacks this year (source)
- Google fixes ninth Chrome zero-day tagged as exploited this year (source)
- Google tags a tenth Chrome zero-day as exploited this year (source)
- Google backports fix for Pixel EoP flaw to other Android devices (source)
- Google says replacing C/C++ in firmware with Rust is easy (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2024-04-05 | CVE-2024-29748 | Improper Handling of Exceptional Conditions vulnerability in Google Android there is a possible way to bypass due to a logic error in the code. | 7.8 |
| 2024-04-05 | CVE-2024-29745 | Use of Uninitialized Resource vulnerability in Google Android there is a possible Information Disclosure due to uninitialized data. | 5.5 |