Privilege Escalation in Android Pixel (CVE‑2024‑29748) Threatens Device Reset Integrity
What It Is — A privilege‑escalation flaw in the Android Pixel operating system allows an attacker to interrupt a factory reset that is initiated by a device‑admin application, potentially retaining control of the device after the reset.
Exploitability — The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. A proof‑of‑concept exists; CVSS v3.1 base score 8.8 (High).
Affected Products — Google Android Pixel smartphones (all models running the vulnerable OS version).
Why It Matters for Trust & Control Assurance
- Highlights the importance of robust access‑control and privileged‑operation monitoring on endpoint devices.
- Underscores the need for continuous patch‑management evidence to satisfy audit requirements for device integrity.
- Demonstrates that a lapse in endpoint controls can erode the defensible audit trail that regulators and enterprise buyers demand.
Recommended Actions
- Deploy Google’s security patch for CVE‑2024‑29748 immediately via your MDM solution.
- Verify that device‑admin apps cannot bypass or interrupt factory‑reset flows after patching.
- Capture compliance evidence (patch version, enforcement logs) for audit readiness.
- Review and tighten privileged‑access policies on all mobile endpoints.
Source: CISA KEV – CVE‑2024‑29748