# Android June 2024 Update: CVE-2024-32896 Zero-Day Exploit Patched > Google fixes 124 vulnerabilities including an actively exploited Pixel firmware zero-day and critical RCE flaws in the June 2024 Android security update. - Published: 2026-06-02T13:27:26.000Z - Severity: critical - Category: Vulnerabilities - Tags: Android, CVE-2024-32896, Pixel, Google, Zero-Day, Privilege Escalation - Author: Runtime Rebel Intel - Primary source: https://www.bleepingcomputer.com/news/security/google-fixes-one-actively-exploited-android-zero-day-124-flaws/ - Canonical: https://runtimerebel.com/blog/android-june-2024-update-cve-2024-32896-zero-day-exploit-patched ## Key points - Attackers are exploiting a firmware zero-day to gain elevated privileges on Pixel devices through targeted attacks. - Google released patches for 124 vulnerabilities affecting Android versions 12, 12L, 13, and 14. - Users must update to the June 2024 security patch level to address the exploited flaw and multiple critical RCEs. Google has addressed a significant number of security flaws in its Android ecosystem, including a high-severity [Zero-Day](/glossary#zero-day) that was being exploited in the wild. According to [BleepingComputer](https://www.bleepingcomputer.com/news/security/google-fixes-one-actively-exploited-android-zero-day-124-flaws/), the June 2024 update includes fixes for 124 vulnerabilities, split across two distinct patch levels. The most pressing of these is [CVE-2024-32896](/cve/cve-2024-32896), an elevation of privilege flaw identified in Pixel firmware. While Google initially restricted the disclosure of exploitation details, the advisory confirms that there are indications this [CVE](/glossary#cve) is under limited, targeted exploitation. ## Analysis of CVE-2024-32896 and Impact The vulnerability marked as CVE-2024-32896 represents a significant [Privilege Escalation](/glossary#privilege-escalation) risk within the Pixel subsystem. In a typical attack scenario, a malicious actor could leverage this flaw to bypass security boundaries and gain system-level permissions. Forensic analysis indicates that this vulnerability has been used in targeted attacks, a common [TTP](/glossary#ttp) for advanced persistent threat actors seeking to compromise mobile devices for data exfiltration or surveillance. Unlike many common vulnerabilities, this specific flaw resides in the firmware, making it more difficult to detect via traditional [EDR](/glossary#edr) or mobile security solutions. The exploitation of firmware-level bugs allows attackers to persist across reboots and remain hidden from standard OS-level security checks. This underscores the necessity of timely hardware-specific updates from original equipment manufacturers (OEMs). ## Broad Scope of the June 2024 Patches Beyond the Pixel-specific zero-day, the June update addresses a wide range of critical issues across the Android Open Source Project (AOSP) and third-party components. Google categorizes the fixes into two levels: * **2024-06-01 Security Patch Level:** Focuses on core Android components, including the Framework and System. This level addresses 37 vulnerabilities, including Critical [RCE](/glossary#rce) flaws. An [RCE](/glossary#rce) in the System component is particularly dangerous as it could allow an attacker to execute code remotely without requiring user interaction or extensive privileges. * **2024-06-05 Security Patch Level:** Includes the previous fixes plus an additional 87 patches for the Kernel and third-party components from vendors like ARM, Imagination Technologies, MediaTek, and Qualcomm. These include a high-severity flaw in the ARM Mali GPU driver, which has also seen exploitation in separate campaigns. For many [SOC](/glossary#soc) teams, understanding the Android June 2024 security patch levels is vital for maintaining a compliant and secure mobile workforce. The 2024-06-05 level is the most comprehensive, covering several high-impact vulnerabilities in Qualcomm and ARM components that are foundational to modern smartphone architecture. ### How to detect CVE-2024-32896 exploit activity Detecting exploitation at the firmware level is a complex task. Organizations should monitor for unusual device behavior, such as unexplained battery drain, unexpected reboots, or unauthorized modifications to system settings. Using a [SIEM](/glossary#siem) to aggregate mobile device management (MDM) logs can help identify devices that have failed to apply the necessary Pixel firmware privilege escalation mitigation updates. If a device remains on a patch level prior to June 2024, it should be considered at high risk for exploitation. ## Mitigation and Recommendations The primary mitigation for these vulnerabilities is the immediate installation of the June 2024 security updates. For Pixel users, this is delivered via the Google Play system update and firmware updates. For non-Pixel devices, the timeline depends on the manufacturer, but the 2024-06-05 patch level should be the baseline for organizational security policies. Defenders should also consider implementing [Zero Trust](/glossary#zero-trust) principles for mobile access to corporate resources. By ensuring that only fully patched devices can access sensitive data, the impact of a [Zero-Day](/glossary#zero-day) exploit is significantly reduced. This approach aligns with the [MITRE ATT&CK](/glossary#mitre-att-ck) framework's guidance on mitigating exploitation of remote services and system software vulnerabilities. **Related:** [Chrome 146 Patch: Two Exploited Zero-Days CVE-2025-0672 and CVE-2025-0673](/blog/chrome-146-patch-two-exploited-zero-days-cve-2025-0672-and-cve-2025-0673), [CVE-2024-4947 and CVE-2024-4948: Google Patches Chrome Zero-Days](/blog/cve-2024-4947-and-cve-2024-4948-google-patches-chrome-zero-days) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/android-june-2024-update-cve-2024-32896-zero-day-exploit-patched