Is CVE-2024-29748 (Android Pixel Privilege Escalation) being exploited in the wild?

How CISA KEV status answers the “exploited in the wild” question

The key signal here is CISA’s inclusion of the issue in the CISA Known Exploited Vulnerabilities Catalog. That designation means CISA has enough confidence that active exploitation is happening to justify operational attention, not just theoretical concern. For defenders, that moves the issue from routine tracking to immediate exposure review and remediation prioritisation.

Because the vulnerability affects Android Pixel and involves privilege escalation, the practical question is whether any managed or unmanaged Pixel devices in your fleet can still reach the vulnerable state. In mobile environments, that means checking inventory, ownership, patch status, and whether the devices are enrolled in controls that can force timely update compliance.

What this means for Android Pixel fleet exposure

The vulnerability lets an attacker interrupt a factory reset triggered by a device admin app, which matters because reset flows are often treated as a cleanup or containment step. If that control can be interrupted, the device may remain in a state that is easier to abuse, investigate, or retain for follow-on access than the organisation expects.

That makes exposure broader than a single handset bug. Any environment that relies on Android Pixel devices for corporate email, work profiles, or administrative access should treat the issue as a device trust problem, not only an operating system patching issue. The relevant question is whether an attacker with local or adjacent opportunity can keep a compromised device from being reliably wiped.

Why this vulnerability is operationally urgent

Actively exploited vulnerabilities deserve faster treatment than ordinary patch backlog items. The difference is not just timing, it is blast radius. Once a flaw is in KEV, defenders should assume exploitation may already be automated, opportunistic, or repeated across multiple targets, which makes delayed action materially riskier than waiting for a normal maintenance cycle.

That is why CISA’s KEV catalogue and vendor guidance should be consulted together. The catalogue tells you the issue is being abused in the real world, while the vendor advisory tells you exactly how to remove the vulnerable condition. For a mobile fleet, the operational implication is that update enforcement, user communication, and exception handling need to be coordinated, not handled as isolated tasks.

Risk and Threat Considerations

When a device reset can be interrupted, the main risk is that administrators may overestimate the reliability of a containment or recovery action. An attacker who can preserve access through reset disruption may keep a foothold long enough to steal data, maintain persistence, or delay incident response.

Failure mechanism: The weakness creates a gap between the intended wipe action and the actual device state, so the device may not be restored to a trusted baseline even after administrators believe it has been reset.

Impact: That can leave sensitive corporate data, accounts, or management trust exposed, and it can complicate both incident containment and device re-enrolment decisions.

Practitioner Guidance

What to verify: Confirm whether any Pixel devices in scope are still running a vulnerable build and whether they are used for privileged access, corporate email, or admin workflows. Prioritise devices that are unmanaged, overdue on updates, or difficult to monitor centrally.

Decision rule: If a device cannot be patched promptly, treat it as a higher-risk endpoint and limit its access until it is brought to a trusted state. If it is already suspected of compromise, do not rely on reset alone as proof of cleanliness, because the exploit directly affects the reliability of that action.

Practitioner takeaway: KEV status is the strongest practical indicator that exploitation is real; the right response is to validate exposure first, then restore device trust with enforced remediation rather than assuming a reset or future patch will eliminate the risk on its own.

Related resources from NHI Mgmt Group

• Guide: Mobile Device Security Guide
• Is CVE-2024-32896 (Android Pixel Privilege Escalation) being exploited in the wild?
• How do you patch or mitigate CVE-2024-29748 (Android Pixel Privilege Escalation)?
• Is CVE-2024-43093 (Android Framework Privilege Escalation) being exploited in the wild?
• CVE-2024-29748 (Android Pixel Privilege Escalation)