Keystroke-injection into Pixel 4a (5G) over unauthenticated Bluetooth(All Pixel devices are impacted)

2023-12-0100:00:00

Google

osv.dev

keystroke-injection

pixel 4a

bluetooth

input validation

privilege escalation

user interaction

software

0.001 Low

EPSS

Percentile

35.7%

JSON

In multiple locations, there is a possible way to inject keystrokes due to improper input validation. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CPENameOperatorVersion
platform/packages/modules/bluetootheq11
platform/packages/modules/bluetootheq14
platform/packages/modules/bluetootheq13
platform/packages/modules/bluetootheq12
platform/packages/modules/bluetootheq12L

Name	Operator	Version
platform/packages/modules/bluetooth	eq	11
platform/packages/modules/bluetooth	eq	14
platform/packages/modules/bluetooth	eq	13
platform/packages/modules/bluetooth	eq	12
platform/packages/modules/bluetooth	eq	12L