Google to Fix Security Vulnerability on Pixel Phones That Could Allow Remote Access or Control: Report

A preinstalled system application called Showcase could be leveraged to inject malicious code or run spyware on Pixel phones, according to security firm.

Written by David Delima | Updated: 16 August 2024 14:08 IST

Google to Fix Security Vulnerability on Pixel Phones That Could Allow Remote Access or Control: Report

Google Pixel phones shipped since late 2017 reportedly contain the vulnerable app

Highlights

Google's Pixel phones shipped since 2017 contained a security flaw
A preinstalled app used for in-store demos could be misused by hackers
Google reportedly plans to remove the app, which is no longer in use

Google Pixel phones were shipped with an application that could potentially be misused by hackers to spy on users' smartphones, an investigation by three security companies has revealed. A hidden Android package on the company's handsets that was used to demonstrate features at a US telecommunications firm's stores contains a security vulnerability, according to security firm iVerify. Google has reportedly confirmed that the application in question, which is inactive by default, will be removed from Pixel phones in the future.

Google Pixel Phones Shipped With Vulnerable 'Showcase' Application

According to a report by cybersecurity firm iVerify, an insecure smartphone was detected at one of its clients, Palantir Technologies. When the handset in question was inspected, the security firm found an application called Showcase that was preinstalled on all Pixel phones.

The Showcase application was created by a firm to enable demos for Google Pixel phones at Verizon stores in the US, according to the company. While the vulnerable application is preinstalled on all of Google's smartphones sold since 2017, it is not enabled by default. Meanwhile, Gadgets 360 was unable to locate the Showcase app on the Pixel 8 review unit sent by the company.

Google Adds New AI Accessibility Features for Pixel Phones and Android

The Showcase app runs at the system level, which allows it a greater level of access to a user's phone compared to applications installed via the Play Store. It is unclear why Google shipped an application on all Pixel phones, instead of including it on models that were required for in-store demos in the US.

While Pixel smartphones are widely considered to be some of the most secure Android phones, the vulnerability — if enabled — could allow attackers to perform a man-in-the-middle (MITM) attack, inject malicious code and execute it, or even run spyware on a user's phone, according to iVerify. The security firm states that Palantir now plans to phase out Android smartphones and transition to iPhone models over the coming years.

The security firm states that it provided Google with a vulnerability report as part of the latter's 90-day disclosure process, but did not receive a response from the company. In a statement to the Verge, a Google spokesperson said that the company had “seen no evidence of any active exploitation” of the Showcase app and that would be removed from all Pixel smartphones "in the coming weeks".

Google Pixel 8

REVIEW
KEY SPECS
NEWS

Design
Display
Software
Performance
Battery Life
Camera
Value for Money

Good
Smaller form factor makes it more comfortable to hold
Excellent and bright display
Cameras are still the best
Packed with AI features

Bad
Battery life is still not the best
Expensive
Tends to heat up under heavy load

Read detailed Google Pixel 8 review

Display 6.20-inch

Processor Google Tensor G3

Front Camera 11-megapixel

Rear Camera 50-megapixel + 12-megapixel

RAM 8GB

Storage 128GB, 256GB

Battery Capacity 4575mAh

OS Android 14

Resolution 1080x2400 pixels

More Google mobiles Google mobiles price in India

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Further reading: Google Pixel, Google, Cybersecurity

David Delima

Email David Delima

As a writer on technology with Gadgets 360, David Delima is interested in open-source technology, cybersecurity, consumer privacy, and loves to read and write about how the Internet works. David can be contacted via email at DavidD@ndtv.com, on Twitter at @DxDavey, and Mastodon at mstdn.social/@delima. More