User Build misconfiguration resulting in local escalation of privilege

CVE-2023-48418

Summary

The vulnerability identified within DeviceVersionFragment.java in Pixel Watch allows unauthorized access to Android Debug Bridge (adb) due to an insecure default configuration before the superuser workflow (SUW) is completed. This issue enables a potential local escalation of privileges without necessitating any additional execution rights or user interaction, making the device more susceptible to exploit attempts by malicious actors. This emphasizes the need for timely security updates and proper configuration management to mitigate potential risks.

References