Android Pixel CVE-2024-32896: Exploited Wipe Bypass

What to do

1. Report the security patch level of every enrolled Android device from your MDM and flag anything earlier than 2024-09-01 (2024-06-05 for Pixels).
2. Check single devices in Settings > About phone, or with adb shell getprop ro.build.version.security_patch.
3. Use MDM compliance rules to block corporate access from devices below the threshold.
4. Replace devices that no longer receive security updates.
5. When a device goes missing, revoke its tokens and certificates server-side instead of relying on remote wipe alone.

How to check if you are affected or compromised

• There are no public indicators; the question is whether a device was lost, stolen or seized while below the fixed patch level.
• Review MDM logs for wipe commands sent to such devices that were never confirmed as completed.
• If a vulnerable device left your control, treat its data as exposed and rotate the credentials, tokens and certificates it held.

What happened#

On June 11, 2024, Google's Pixel Update Bulletin listed CVE-2024-32896 as a high-severity elevation of privilege bug, filed under "Pixel Firmwire" (sic). It added: "There are indications that CVE-2024-32896 may be under limited, targeted exploitation." The CVE record says only that a logic error allows a bypass leading to local privilege escalation, with user interaction needed. NVD scores it CVSS 3.1 7.8. CISA added it to the KEV catalog on June 13, 2024.

Google's acknowledgements credit Daniel Micay of the GrapheneOS Foundation. GrapheneOS explained that this is the second part of the fix for CVE-2024-29748, which the April 2024 Pixel bulletin also flagged as exploited. Both IDs cover one weakness. A wipe triggered through the device admin API depended on rebooting into recovery, and someone holding the phone could interrupt that reboot and keep the data. GrapheneOS attributed exploitation to forensic companies. The April fix was a Pixel bootloader mitigation. The full fix is "wipe without reboot," which shipped in Android 14 QPR3 (AOSP topic fbe-wipe-no-reboot).

Who is affected#

Despite the Pixel label, GrapheneOS said the issue "applies to all devices." Google later fixed it more broadly. The September 2024 Android Security Bulletin listed CVE-2024-32896 under Framework for Android 12, 12L, 13 and 14 at the 2024-09-01 patch level, and repeated the exploitation note.

• Pixels: fixed at security patch level 2024-06-05 or later.
• Other Android devices: fixed at patch level 2024-09-01 or later, if the manufacturer shipped it.
• Still exposed: devices that stopped getting updates before then, including Android 11 and older, which the September bulletin did not list.

Do you really need to act?#

Only if you still have old devices. The attack requires physical possession, and GrapheneOS stated plainly that it is not remote. The risk is a lost, stolen or seized phone whose owner or admin sends a wipe and assumes the data is gone. Most maintained devices passed the fixed patch levels in 2024, so for a managed fleet this is a compliance check. It matters most to organizations that rely on remote-wipe or failed-unlock wipe policies, and to people at risk of device seizure, such as journalists, lawyers and activists.

What to do now#

1. Export the security patch level for every enrolled Android device from your MDM. Flag anything earlier than 2024-09-01, or 2024-06-05 for Pixels.
2. Check a single device under Settings > About phone > Android version, or run adb shell getprop ro.build.version.security_patch and adb shell getprop ro.build.version.release.
3. Use MDM compliance rules to block corporate email, VPN and SSO from devices below the threshold.
4. Replace devices that no longer get updates. GrapheneOS notes that end-of-life Pixels cannot receive the April 2024 firmware fixes at all.
5. Do not rely on remote wipe alone. Require a strong lock-screen secret, and revoke a missing device's sessions, tokens and certificates on the server side.

How to tell if you were hit#

Neither Google nor CISA has published indicators, and exploitation happens on a device in someone else's hands. The question is historical. Was any device lost, stolen or seized while below the fixed patch level and then wiped remotely? If so, assume the wipe may not have finished and treat its data as exposed. Check MDM logs for wipe commands that were never confirmed. Rotate the passwords, tokens and VPN or Wi-Fi certificates the device held, and review account activity tied to it afterward.

Timeline#

• Apr 2, 2024 — The Pixel bulletin fixes CVE-2024-29748 with a bootloader mitigation and flags it as exploited.
• Apr 12, 2024 — The wipe-without-reboot change is merged into AOSP.
• Jun 11, 2024 — The Pixel bulletin fixes CVE-2024-32896 at patch level 2024-06-05.
• Jun 13, 2024 — The CVE is published, and CISA adds it to KEV.
• Jul 4, 2024 — CISA's federal remediation deadline.
• Sep 3, 2024 — The Android Security Bulletin extends the fix to Android 12 through 14 at patch level 2024-09-01.

Vulnerability records

• CVE-2024-32896 · KEV 2024-06-13 · there is a possible way to bypass due to a logic error in the code.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Android — Pixel Update Bulletin, June 2024 source.android.com
2. Android — Android Security Bulletin, September 2024 source.android.com
3. Android — Pixel Update Bulletin, April 2024 source.android.com
4. Android — Security acknowledgements source.android.com
5. CVE record — CVE-2024-32896 cve.org
6. NVD — CVE-2024-32896 nvd.nist.gov
7. CISA — Known Exploited Vulnerabilities: CVE-2024-32896 cisa.gov
8. AOSP — Merge changes from topic fbe-wipe-no-reboot (frameworks/base) android.googlesource.com
9. GrapheneOS — CVE-2024-32896: wipe-without-reboot added to AOSP due to reports by GrapheneOS discuss.grapheneos.org