CVE-2023-48418 is a critical (CVSS 10.0) flaw in Pixel Watch firmware that allowed access to adb before setup was completed, because of an insecure default. Google's December 2023 bulletin lists it as High. Install the update with security patch level 2023-12-05 or later.
What's affected
The NVD description says that in checkDebuggingDisallowed of DeviceVersionFragment.java there is a possible way to access adb before setup wizard completion, due to an insecure default value. It can lead to local escalation of privilege with no extra privileges and no user interaction. The weakness is CWE-269 (Improper Privilege Management).
There is a conflict on severity. The record scores it 10.0 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. Google's Pixel Watch Security Bulletin for December 2023, published on 11 December 2023, lists it as an elevation of privilege flaw with severity High, in the google_clockwork component, under Android bug A-296051696. The two sources disagree on both the score and the severity, so treat the vendor rating as the rating of the patch and the NVD score as the worst case.
The bulletin says security patch levels of 2023-12-05 or later address the issues in that bulletin. The record does not flag the CVE as exploited in the wild, and the bulletin does not say so either.
How to check if you're exposed
Check the security patch level on the watch, using the instructions in the Pixel Watch bulletin's common questions section. A patch level of 2023-12-05 or later includes the fix.
On the paired phone, the watch companion app shows the watch software version and whether an update is available. If your watches are not paired to a managed phone, ask each owner to check.
Fleet owners should list every Pixel Watch in use, including spares kept in a drawer. Such devices miss updates, and the flaw concerns the period before setup finishes, so a factory reset or newly unboxed watch is the case that matters most.
What to do now
- Update every Pixel Watch to a build with security patch level 2023-12-05 or later.
- Finish setup on new or reset watches only after updating, where you can control the order.
- Keep spare watches charged and updated, or record that they are out of service.
- Read the Pixel Watch bulletin for December 2023 for the other fixes it lists.
- Add wearables to your device inventory with model and patch level.
Why it matters
A secure default is one where a risky feature starts off disabled. Here, the check that should have blocked debugging access during setup relied on a value that allowed it. A debug bridge is a developer tool with deep access to a device, so an open default during setup gives whoever is nearby a way in at the one moment the owner is not yet in control.
The gap between a 10.0 and a High rating shows how different scoring views can be. Scores reflect assumptions about how reachable the weakness is. Your own risk depends on whether anyone can touch the device in that early state. See the Safeguard Gold page for this CVE for the record.
Quick check
Which patch level fixes CVE-2023-48418?
The Pixel Watch bulletin says patch levels of 2023-12-05 or later address the issues it lists, including this one.
Why is it Critical in NVD but High from Google?
The sources score it differently. NVD gives 10.0, and the Google bulletin lists the severity as High.
Sources
Last reviewed: 19 October 2026.
