Google issues Update Now warning for Pixel users
For the second time in just 12 weeks, Google has suddenly warned owners of its Pixel smartphones that a new security flaw “may be subject to limited and targeted exploitation.” The August security update is now available and you need to make sure to install it on your device as soon as it’s available for your model, carrier and region.
The new threat affects the Android kernel, and Google says it “could lead to remote code execution, requiring system execution privileges.” As always with such vulnerabilities, there are few additional details at this early stage, but the known exploit appears to have been discovered by Google’s own TAG threat hunters, and is therefore likely attributed to a large cyber group, spyware organization, or even a nation-state.
Although Google tells users that “patches to the source code will be released to the Android Open Source Project (AOSP) repository over the next 48 hours,” suggesting delays for non-Pixel users, Samsung appears to have prioritized a bug fix included in its own August security update, which was released on Tuesday, the same day as the Pixel update.
In addition to the zero-day update, there are a number of other security and bug fixes in both the general Android and the specific Pixel update for this month. None of the others are highlights and most Android users will now be more focused on the release of Android 15. It is expected that a schedule could be confirmed later this month.
Android 15 significantly raises the bar on security protection for Pixel and other OEMs, with new features like protection against cellular interception technologies, scam callers, and device theft. But the most important update is AI-powered Live Threat Detection, which can monitor an app’s behavior on the device and alert if it appears to be following patterns typically seen in malicious installations.
Android 15 comes just as Google is tightening its Play Store rules, promising to delete thousands of low-quality apps, including those most likely to hide threats. There’s also a noticeable tightening of Play Protect restrictions and less open flexibility when it comes to sideloading apps from less reputable sources.
As for the new zero-day, there seems to be much stronger coordination between Google and other OEMs this time around. The June update was a mess. The vulnerability was initially flagged for Pixels only before Google confirmed that it affected other devices as well.
This zero-day prompted the US government to add the threat to its catalog of known exploited vulnerabilities and give federal employees with Pixel devices 12 days to update their phones or stop using them. We don’t yet know if the same thing will happen to us this time. If so, I’ll provide an update here.
In the meantime, keep an eye out for the August update on your phone.
