CVE-2017-13247: In the Pixel 2 bootloader, there is a missing permission check which bypasses carrier bootloader lock.

Security readout for executives and security teams

This issue affects Pixel 2 bootloader behavior: a missing permission check could let a local user bypass a carrier bootloader lock. That matters mainly for legacy or unmanaged Pixel 2 devices where bootloader lock state is relied on for device control. The public record does not show active exploitation. Exposure appears limited to Pixel 2 devices or Android builds covered by Google’s February 2018 Android security bulletin. Organizations with no Pixel 2 fleet or only updated devices are less likely exposed. Treat this as a legacy mobile fleet hygiene issue unless Pixel 2 devices remain in use. Prioritize inventory, patch confirmation, and retirement of unsupported devices over emergency response. Mitigation focus: Review Google’s February 2018 Android Security Bulletin for the applicable remediation.; Confirm affected Pixel 2 devices received the relevant Android security update.; Retire or isolate unsupported Pixel 2 devices that cannot receive vendor fixes..

Prepared

Jun 7, 2026, 20:58 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.