Google usually sticks to a pretty tight schedule when updating its Pixel phones, but it looks like the company hit the snooze button recently. We normally see security patches on the first Monday of every month, but the March 2023 security update for most Pixel users only came the second mondayAnd Pixel 6 owners even had to wait an extra week on top of that. Now the April 2023 security update is apparently also delayed.
At 10 a.m. Pacific (10:15 a.m. latest), we usually see a message from Google on the Pixel Community Forums announcing the new update. This time has come and gone with no sign of new firmware – not even on Google factory pictures page or his OTA download site. What we got, however, was a new Android security bulletin for April 2023.
The security bulletin affects all Android devices, not just Pixel devices. It discloses Common Vulnerabilities and Exposures (CVEs) that have recently been discovered and software patches that Google has released to harden Android’s security against said vulnerabilities.
This month’s security bulletin has its patches split into two tiers of security patches, which has become the norm as Google tries to make it easier to roll out updates for Android OEMs. The first April 1 patch level outlines fixes for 28 CVEs in the Android system and framework, while the second contains 41 fixes for vendor-specific CVEs and has a date of April 5.
A total of 69 CVEs have been fixed, of which 6 were deemed critical: CVE-2023-21085, CVE-2023-21096, CVE-2022-33231, CVE-2022-33288, CVE-2022-33289 and CVE-2022- 33302. The worst of these vulnerabilities was an Android system CVE that allowed a nearby attacker to execute code on a target device without physical access or user interaction.
Google is releasing a separate security bulletin with Pixel-specific fixes, but like the April security update for Pixel devices, this has yet to appear. When it does, you should be able to find the list of fixes here. The question remains, will it be tomorrow, Wednesday or next week? We’ll stay tuned and update this post when we spot anything.