As Checkmarx Senior Security Researcher Pedro Umbelino explains, the team started their investigation by having a look at the Google Camera app on Pixel 2 XL and Pixel 3 handsets. They found multiple vulnerabilities relating to permission bypass issues which could allow an attacker to use the app to take photos and record videos via a rogue app.
Attacks are even possible when a victim’s phone is locked, the screen is off and during voice calls.
Other attack scenarios could allow a bad actor to access stored photos and videos and even garner GPS metadata to help track down the location of a user.
