The exploited flaws, tracked as CVE-2024-29745 and CVE-2024-29748, impact Pixel’s bootloader and firmware, Google notes in its advisory.
The internet giant says it has indications that these two security defects “may be under limited, targeted exploitation,” without providing specific details on the observed attacks.
Google has often linked these types of vulnerabilities to commercial spyware vendors.
A total of 24 vulnerabilities leading to elevation of privilege (EoP) and information disclosure were addressed in various Pixel components, and another was resolved in Qualcomm components.
