Android has patched a critical vulnerability that allows users with physical access to a locked Google Pixel smartphone to bypass the lock screen without providing the device’s pin/password or biometric key. The flaw was found by security researcher David Schütz who was awarded $70,000 as part of Google’s bug bounty program. The vulnerability, tracked as CVE-2022-20465, can be exploited in an easy five (5) step process which is detailed in Schütz’s writeup, and leads to local escalation of privilege with no additional execution privileges or user interaction needed. Schütz states that to exploit the flaw, users must supply an incorrect fingerprint three (3) times in a row, which disables biometric authentication. The attacker then swaps the phone’s physical SIM card with an attacker-controlled SIM card that has a pin that the attacker knows. The attacker will purposefully enter the wrong pin three (3) times in a row, locking the SIM card, prompting the device to ask for the user’s SIM card’s Personal Unlocking Key (PUK) code. The attacker then enters their own pin, and the device automatically unlocks. This vulnerability has been patched by Google, and all Pixel users should ensure that they are running the latest stable version of the software. CTIX analysts will continue to report on interesting vulnerabilities.