CVE-2024-29748

What it actually does

CVE-2024-29748 is a local privilege escalation vulnerability affecting Google Android/Pixel devices. A logic error allows a local attacker to bypass an intended security check and perform actions with higher privileges than should be available. Successful exploitation can compromise confidentiality, integrity, and availability on the device, including access to protected data, modification of security-sensitive state, and potential support for persistence or follow-on exploitation. The flaw requires user interaction but does not require the attacker to already hold additional execution privileges.

Why it matters to the business

Compromised Android or Pixel devices may expose corporate data, authentication tokens, messaging content, application data, and device-managed secrets. Because this vulnerability is listed in CISA KEV and has been exploited in the wild, it should be treated as a priority for any organization with managed or unmanaged Android devices accessing business resources. Exploitation is especially concerning for executives, administrators, developers, incident responders, finance users, and other high-value mobile users, where device compromise can lead to account takeover, data theft, fraud, or broader intrusion into cloud and enterprise services. CISA’s KEV remediation deadline was 2024-04-25, so unpatched devices are materially overdue for remediation.

How an attack unfolds

An attacker first needs a way to get a target user to interact with attacker-controlled content, an app, or another local trigger path on an affected Android/Pixel device. After that interaction, exploit code abuses the vulnerable logic path to bypass a security restriction that should prevent the requested privileged action. If successful, the attacker obtains elevated local privileges on the device and can use those privileges to access protected data, tamper with system or application state, disable or evade security controls, or stage additional malware. In real-world campaigns, this type of vulnerability is commonly chained with an initial access technique such as malicious apps, social engineering, browser or messaging exploitation, or physical/local access. The vulnerability has been associated with active zero-day exploitation campaigns involving espionage and financially motivated actors, so defenders should assume targeted exploitation is plausible against high-risk users.

How to fix it

Apply vendor security updates for all affected Android and Google Pixel devices. For Pixel devices, update to the April 2024 Pixel security update or any later build that includes the fix for CVE-2024-29748. For Android devices from other OEMs, deploy the vendor-provided Android security update that incorporates the April 2024 Android Security Bulletin fixes or later. Where immediate patching is not possible, restrict access to corporate resources from devices below the required Android security patch level, enforce mobile device management compliance checks, block sideloading and unknown app sources where feasible, require Play Protect or equivalent mobile threat defense, and prioritize patching for high-risk users and devices with access to sensitive systems. Because this issue is in CISA KEV and was exploited in the wild, compensating controls should be treated as temporary only.

How to confirm the fix worked

Confirm that affected devices report an Android security patch level and/or Pixel build date at or after the vendor update containing the April 2024 fix. Validate through MDM/UEM inventory, device compliance policies, Android Settings, or enterprise mobile threat defense telemetry. For Pixel devices, verify that the installed build is the April 2024 security update or later. For non-Pixel Android devices, verify the OEM advisory and patch level that includes the April 2024 Android security fixes. Confirm that devices below the required patch level are quarantined, blocked from sensitive resources, or scheduled for remediation. Re-scan mobile inventory after patch deployment to ensure no stale, offline, personally owned, or exception devices remain exposed.

Typical attack path

1. Identify a target using an affected Android or Google Pixel device that has not received the April 2024 or later security update containing the fix.
2. Deliver or stage a malicious local trigger, such as a malicious app, exploit chain component, or attacker-controlled content that requires user interaction.
3. Convince the user to open, install, approve, or otherwise interact with the malicious content or workflow.
4. Invoke the vulnerable logic path to bypass the intended security control.
5. Gain elevated local privileges on the device.
6. Use elevated privileges to access protected data, modify security-sensitive settings, deploy spyware or other malware, persist, or support additional account and cloud compromise.

How to detect it

Look for evidence of exploitation on devices that were unpatched before receiving the April 2024 or later security update. Useful sources include MDM/UEM device inventory and compliance history, Android security patch level history, mobile threat defense alerts, Android logcat captures where available, app installation and permission grant history, Play Protect events, EDR-for-mobile telemetry, enterprise SSO logs, VPN logs, cloud application access logs, and identity provider sign-in records. Focus on devices that had suspicious user interaction shortly before unusual behavior, such as installation of unknown apps, sudden permission changes, accessibility service enablement, device administrator enrollment, unexpected profile changes, USB debugging enablement, root/jailbreak detections, Play Protect disablement, unusual background processes, or new persistence mechanisms. Because public reporting for this CVE does not provide a stable exploit filename, process name, command line, or network signature, detection should be behavior-based and scoped to vulnerable device populations. For suspected compromise, preserve device telemetry, collect a forensic image where legally and technically feasible, review installed packages and signing certificates, check for spyware-like behavior, rotate credentials used from the device, and review downstream account activity after the suspected exploitation window.

What your security team should do

• Treat this as an actively exploited mobile privilege escalation issue and prioritize remediation for all Android and Pixel devices with business access.
• Enforce a minimum Android security patch level of April 2024 or later, or the OEM-specific fixed build containing the April 2024 security bulletin fix.
• Use MDM/UEM compliance rules to block or quarantine noncompliant devices from email, VPN, SSO, cloud apps, and privileged administrative access.
• Prioritize executive, finance, legal, engineering, administrator, and incident response mobile devices for immediate validation and patching.
• Review mobile threat defense alerts, MDM device posture history, app install history, and suspicious local privilege escalation indicators on high-risk or previously unpatched devices.
• Disable or tightly control sideloading, unknown app sources, developer options, USB debugging, and unmanaged app installation where business requirements allow.
• For devices that cannot be updated, remove corporate access, rotate credentials used from those devices, and consider device replacement.
• Monitor for targeted mobile exploitation activity associated with spyware, espionage, and financially motivated campaigns, especially where users received suspicious messages, links, files, or app installation prompts.