CVE-2023-48419

The attacker must be within the physical range of the victim's Wi-Fi network. Without any privileges or user interaction, they are able to conduct an attack resulting in privilege escalation. The detailed technical mechanism has not been disclosed in the available description, however the full CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) indicates a vulnerability accessible remotely over the network, requiring no complicated conditions or prior privileges.

An attacker can obtain unauthorized elevated privileges on the device and spy on the victim — potentially gaining access to audio captured by the device's microphone. The vulnerability scope (Scope: Changed) suggests the possibility of exceeding the context of the device itself.

Apply patches available from the manufacturer according to references (Google support page: support.google.com/product-documentation/answer/14273332). Google Home devices typically update automatically — verify that devices have automatic software updates enabled.

Google Nest Audio (firmware), Google Nest Mini (firmware), Google Home Mini (firmware) — specific versions indicated in manufacturer references