CVE-2024-32896: Android Pixel logic error allows local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is in CISA KEV with known exploitation and a CVSS of 7.8, though it requires local access and user interaction.

What it is

CVE-2024-32896 is a logic error in Android (CWE-670/CWE-783) that permits a local attacker to bypass intended restrictions and escalate privileges. It affects Google Pixel devices per the vendor bulletin. Because it is listed in CISA KEV, it is being exploited in the wild and warrants prompt patching.

Impact

A local attacker gains elevated privileges on the device, with high impact to confidentiality, integrity and availability. This can enable further compromise of user data and device controls.

Attack surface

Reached locally (AV:L) with no privileges required (PR:N), but user interaction is required (UI:R). The attacker must already have a foothold or local access on the device and convince the user to perform an action.

Exploitation

CISA added it to KEV on 2024-06-13 with a remediation due date of 2024-07-04, indicating known exploitation. EPSS 30-day probability is about 3.0% (86.6th percentile), and references are vendor advisories plus the KEV entry; no ransomware use is documented.

What to do

• Apply the Google Pixel security bulletin update for June 2024 (or later) as soon as possible.
• If patching is not immediately possible, follow CISA KEV required action: apply vendor mitigations or discontinue use of the affected product.
• Restrict local access and untrusted app installation on affected devices.
• Monitor for and remove suspicious sideloaded or untrusted applications that could trigger the logic error.
• Track device patch compliance and prioritize Pixel devices in the fleet.

Detection

• Monitor for unexpected privilege escalation events or anomalous process token changes on Android devices.
• Review application installs and permission grants around the time of suspected exploitation.
• Correlate device logs for local exploitation attempts against the June 2024 Pixel bulletin.
• Use EDR/MDM telemetry to flag devices missing the June 2024 or later security patch level.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.