A 2022 Android vulnerability let a person with physical access bypass the lock screen on certain tested Pixel phones by completing a SIM card’s PUK reset. It was not a way to recover a forgotten passcode, and the historical report does not show that the flaw works on phones with the relevant security fix installed.
What the Pixel lock-screen bypass did
Security researcher David Schütz reported that he could reach a Pixel’s home screen after completing a SIM PUK reset while the phone was locked. A PUK, or personal unblocking key, is used to unblock a SIM after too many incorrect SIM PIN entries. This was a bug in Android’s lock-screen handling—not a feature for recovering or changing the phone’s passcode.
As an Amazon Associate I earn from qualifying purchases.
Schütz said the sequence began after his Pixel 6 rebooted and requested the SIM PIN. After three incorrect entries, the SIM requested its PUK. His first attempt returned the phone to the lock screen. When he later repeated the reset on a locked device without rebooting, the phone opened to the home screen. He reported reproducing the behavior on a Pixel 6 and a Pixel 5. Schütz’s account of the discovery describes those specific tests; his broader view at the time was that the issue seemingly affected all Pixel devices, which is not the same as testing every model.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat access the attack required
In Schütz’s account, an attacker needed physical access to the phone, a SIM protected by a PIN, and knowledge of that SIM’s correct PUK. The report describes a specific set of conditions, not a general method that opens any locked phone. It does not establish that the technique works on a device that has received the relevant fix.
#1 Best Overall
- Attention-grabbing design meets the latest evolution of the Google Pixel Camera on the new Google Pixel 11 Pro; Gemini Intelligence helps manage details so you can live in the moment[1]; and the phone is available in two sizes
- Unlocked Android phone gives you the flexibility to change carriers and choose your own data plan: Works with Google Fi, Verizon, T-Mobile, AT&T, and other major carriers[2]
- Stay informed without looking at your screen: When your phone is face down, Pixel HiLight gently alerts you with subtle glowing lights when your favorite contacts are calling or you’re talking with Gemini; exclusive to Google Pixel 11 Pro phones
- Magic Capture catches the moment as you live it: With just one tap, Pixel 11 Pro captures video and photos, and automatically edits, crops, and unblurs a curated collection, ready to share – and you get the memory of how it felt to be in the moment
- Two new cameras for more brilliant photos: A larger telephoto sensor captures 30% more light for clear, beautiful photos and videos, even in the dark[3]; Pixel’s longest zoom ever helps you capture details from impressive distances[4]
Why Android treated the SIM reset as a phone unlock
Google’s AOSP commit explains that completing the PUK flow and other SIM-state changes could trigger overlapping requests to dismiss the keyguard—the Android component that protects the lock screen. If the active phone security method changed before a dismissal request ran, the request could be mistaken for successful PIN, pattern, or password authentication. The keyguard could then be marked as complete despite the phone passcode not having been entered. Google’s AOSP change describes this race between system-state changes and keyguard dismissal.
How Google tracked and fixed CVE-2022-20465
Google’s November 2022 Android Security Bulletin identifies the issue as CVE-2022-20465, a high-severity system elevation-of-privilege vulnerability. The bulletin lists updated AOSP versions 10, 11, 12, 12L, and 13, and says security patch levels 2022-11-05 or later address issues associated with that patch level.
Rank #2
- Google Pixel 10a is a durable, everyday phone with more[1]; snap brilliant photography on a simple, powerful camera, get 30+ hours out of a full charge[2], and do more with helpful AI like Gemini[3]
- Unlocked Android phone gives you the flexibility to change carriers and choose your own data plan; it works with Google Fi, Verizon, T-Mobile, AT&T, and other major carriers
- Pixel 10a is sleek and durable, with a super smooth finish, scratch-resistant Corning Gorilla Glass 7i display, and IP68 water and dust protection[4]
- The Actua display with 3,000-nit peak brightness shows up clear as day, even in direct sunlight[5]
- Plan, create, and get more done with help from Gemini, your built-in AI assistant[3]; have it screen spam calls while you focus[6]; chat with Gemini to brainstorm your meal plan[7], or bring your ideas to life with Nano Banana[8]
The code change makes each keyguard dismissal request specify which security method it expects. If the system’s current method no longer matches, Android ignores the request rather than treating a stale request as valid authentication. That guards against the state change that enabled the reported bypass.
Does the vulnerability affect your Pixel today?
The 2022 bulletin documents the historical patch and affected AOSP version list; it does not reveal the update status of a particular handset today. Check your phone’s Android security patch level in Settings under Security & privacy or Security (the label can vary by Android version). A patch level of 2022-11-05 or later meets the bulletin’s stated threshold for issues associated with that patch level, but a current device’s status depends on its installed updates and software build. If in doubt, install available system updates and consult the device maker or carrier about the phone’s build.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How the flaw was disclosed
Schütz says he submitted the report in June 2022, and that Android’s Vulnerability Rewards Program triaged it and filed an internal bug within 37 minutes. He says the issue was later treated as a duplicate; after demonstrating it in person to Google engineers, he received a $70,000 award. Futurism’s November 12, 2022 article tied the incident to the “any Pixel” framing and also reported the reward. Futurism’s report is secondary coverage; the discovery and award timeline above are attributed to Schütz’s first-person account.
Quick Recap
Best Value
- Google Pixel 7 is powered by Google Tensor G2; it’s faster, more efficient, and more secure, with the best photo and video quality yet on Pixel[1].Other camera description:Front,Rear.Bluetooth Version 5.2 with dual antennas for enhanced quality and connection.
- Unlocked Android 5G phone gives you the flexibility to change carriers and choose your own data plan[2]; works with Google Fi, Verizon, T-Mobile, AT&T, and other major carriers
- Pixel’s Adaptive Battery can last over 24 hours; when Extreme Battery Saver is turned on, it can last up to 72 hours[3]
- The 6.3-inch Pixel 7 display is super sharp, with rich, vivid colors; it’s fast and responsive for smoother gaming, scrolling, and moving between apps[4]
- Google Pixel 7 has wide and ultrawide lenses with up to 8x Super Res Zoom[5]; and Cinematic Blur brings more drama to your videos
Rank #4
- Google Pixel 10 Pro is the ultimate Pixel experience, featuring advanced AI with Gemini, unbelievable camera quality, impeccable design in two sizes, and the next-gen Google Tensor G5 chip[1]
- Unlocked Android phone gives you the flexibility to change carriers and choose your own data plan[2]; it works - Google Fi, Verizon, T-Mobile, AT&T, and other major carriers
- Get a head start on syncing your data before it even arrives: After you purchase your new Pixel, look for an email that explains how to transfer your photos, videos, passwords, and more in just a few quick steps[11]
- Pixel’s pro camera system makes everything look amazing, even in low light; capture more of the scene with advanced Google AI models, and bring out incredible details with 100x Pro Res Zoom, stunning 50 MP images, and super steady videos in 8K[10]
- Pixel 10 Pro is built with durable aluminum and Corning Gorilla Glass Victus 2 for scratch and drop resistance; the 6.3-inch Super Actua display with 3,300-nit peak brightness is easy on the eyes, even in direct sunlight[3,13,18]
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
