CVE-2023-48418

The vulnerability lies in an incorrect default value for access control in the checkDebuggingDisallowed function, which is responsible for verifying whether ADB debugging should be blocked during the device setup phase (Setup Wizard, SUW). Since the default value is set in an insecure manner, an attacker can gain access to the ADB shell before the device is properly configured and secured. Exploitation does not require any additional privileges or user interaction.

An attacker with physical or local access to the device can gain elevated privileges through the ADB interface, which in turn allows them to take control of the device before the setup process is completed.

Security patches available from the manufacturer should be applied according to the references — Google Pixel Watch security bulletin dated 2023-12-01 (https://source.android.com/docs/security/bulletin/pixel-watch/2023/2023-12-01).

Google Pixel Watch and Google Pixel Watch firmware (Pixel Watch Firmware); specific versions indicated in the manufacturer's security bulletin from December 2023.