Let me clarify: it's not that some Pixel owners just haven't installed the March update yet. It's that Google hasn't released it it for some Pixel models.
Hang on - if I understand correctly, all of the following is true for Pixel 6, Pro, and 6a users??
- There's an exploit out there that lets attackers own my phone if they know my number
- A patch is not available for my phone yet
- It's not possible to work around the issue because a previous update removed the toggle
- Announcing this signals to every competent black hat worth their salt to begin looking for exploits on this chipset, knowing the reward is high and the method of pulling it off is implied to be simple
I really wish Google had delayed this blog post until after all of their currently supported flagship products were no longer affected...
I don’t think they’re legally required to do so. However they have a very aggressive publication schedule and selectively making exceptions for Google and not for competitors would look terrible, and possibly expose them to lawsuits.
That’s pretty funny. I just bought a pixel 6a with the intent of replacing my iPhone. About an hour of “how the hell do people put up with this shit” and it’s going. Then I wake up to this.
Your brain definitely gets trained on one system and moving off hurts. Hell, I've had my work Macbook for 5 years and I still curse the keyboard shortcuts that are all wrong (and the even more shortcuts that it's missing).
Yes I think it was a week late but is now being rolled out. People on Twitter are saying they don’t have it yet, which is the nature of individual experience.
That is only for CVE-2023-24033 thought, right? Not the other three that haven't been assigned CVE ID's?
> The four most severe of these eighteen vulnerabilities (CVE-2023-24033 and three other vulnerabilities that have yet to be assigned CVE-IDs) allowed for Internet-to-baseband remote code execution.
> affected Pixel devices have already received a fix for CVE-2023-24033 in the March 2023 security update
[0] https://googleprojectzero.blogspot.com/2023/03/multiple-inte...