Google Pixel users have been issued a critical warning by the U.S. government regarding a high-severity firmware vulnerability, CVE-2024-32896. The deadline to update Pixel devices is July 4, giving users just ten days to take action. This warning extends beyond government agencies to include enterprises and personal users who connect their devices to enterprise systems.

The Cybersecurity and Infrastructure Security Agency (CISA) has highlighted the unspecified vulnerability in Android Pixel firmware that allows for privilege escalation. While Google has not disclosed further details, GrapheneOS has indicated that this vulnerability is part of a series of fixes for actively exploited vulnerabilities reported earlier.

GrapheneOS has emphasized that the risk is not limited to Pixel devices, as other Android devices may also be affected. The fix has been implemented in Pixels with the June update but may not be available for other devices until they update to Android 15. Owners of non-Pixel Android devices are left uncertain about immediate mitigation measures.

The vulnerabilities identified by GrapheneOS include memory not being wiped in firmware-based fastboot mode and a dependency on reboot-to-recovery for wiping before Android 14 QPR3. These issues are currently unresolved outside of Pixel devices.

As the situation unfolds, users are advised to stay informed and vigilant about potential security risks associated with their Android devices. The urgency of the situation underscores the importance of prompt updates and compliance with security advisories to mitigate the risk of exploitation.