CVE-2024-32911

The vulnerability lies in improper use of cryptography (CWE-327 — use of a broken or risky cryptographic algorithm, CWE-347 — improper verification of cryptographic signature). Incorrect implementation of cryptographic mechanisms may allow an attacker to bypass security measures based on integrity verification or data authenticity. Exploitation is possible remotely, without the need to possess additional privileges or engage the user.

An attacker can remotely obtain privilege escalation on a vulnerable Android device, potentially gaining full control over the system (confidentiality, integrity, and availability are fully threatened).

Security patches available from the manufacturer should be applied in accordance with references — Pixel Security Bulletin published 2024-06-01 (https://source.android.com/security/bulletin/pixel/2024-06-01). Immediate software update of the device to the latest available version is recommended.

Google Android — versions indicated in manufacturer references (Pixel Security Bulletin from June 2024)