Pixel smartphones contain a vulnerability that allows hackers to install malware or spyware unobtrusively. The vulnerability leaves millions of these devices vulnerable and can only be closed by Google.
The vulnerability resides in the software Showcase.apk. Google ships Pixel phones with this app by default, and because it is labelled a system app, users cannot uninstall it. Google will have to make a fix available to users but says it is still working on it.
Extreme system privileges
The vulnerability was demonstrated by iVerify, which put the findings out in a report. Because the APK receives a configuration file through an unsecured domain on AWS, a hacker can intercept this connection. This makes it possible to install malware or spyware on a device. Hackers will have to open the connection themselves, something iVerify says specialized hackers are capable of doing.
The software is inactive in its normal state, as Showcase.apk is not an app that Pixel smartphone users need. The installation only served to demonstrate the functionalities of Pixel smartphones in Verizon stores. Showcase has extremely high system privileges for this reason, making it easy for hackers to install malware once the connection is intercepted.
Verizon has since abandoned the use of Showcase. The U.S. telecom vendor says it sees no evidence of exploitation. A Google spokesman reported something similar to The Washington Post. There would be no active exploitation, and no attacks linkable to the vulnerability have been identified in the past.
Problem may not be unique to Pixel
Because Showcase.apk is a product of Smith Micro Software and was not designed uniquely for Pixel devices, Google contends that devices from other manufacturers could also be at risk. The company is, therefore, notifying competing Android device manufacturers of the problem and the upcoming fix.
In fact, Google already no longer ships the software with Pixel 9 devices. The first delivery from this line will be the Pixel 9 Pro XL on Aug. 22.
Also read: Google Pixel 9 line announced: foldable shipping to more European countries