# Accidental $70k Google Pixel Lock Screen Bypass

Race in Android security-screen dismiss() let a SIM PUK reset dismiss the fingerprint lock screen, unlocking any Pixel with physical access.

- Payout: $70,000
- Severity: high
- Program: Google
- Credited: David Schütz
- Disclosed: 2022-11-10
- CVE: CVE-2022-20465
- Write-up quality: 8/10
- Original: https://bugs.xdavidhu.me/google/2022/11/10/accidental-70k-google-pixel-lock-screen-bypass/
- Library page: https://bugbountylibrary.com/r/blog%3Abugs-xdavidhu-me-google-2022-11-10-accidental-70k-google-pixel-lock-screen-bypass
- Tags: domain:mobile impact:ato impact:privesc kind:bounty platform:blog sev:high tech:android technique:race-window technique:source-review vuln:access-control vuln:auth-bypass vuln:race-condition

**Target:** Android lock screen / SIM PUK security screen stack
**Root cause:** The PUK reset component called a parameterless security-screen .dismiss(), which dismissed whatever screen was currently active; a background SIM-state monitor swapped the active screen to the fingerprint screen before the dismiss, so the fingerprint lock screen got dismissed and the device unlocked.
**Steps:**
1. Lock the device (or fresh boot) with a PIN-locked SIM inserted.
2. Enter wrong SIM PIN 3 times to trigger PUK requirement.
3. Enter the PUK and set a new SIM PIN.
4. Race: background SIM monitor sets fingerprint security screen active before PUK component calls .dismiss().
5. PUK component's .dismiss() dismisses the fingerprint screen, landing on the home screen unlocked.
**How found:** Accidentally noticed after a reboot that the fingerprint icon appeared instead of the PIN prompt post-PUK-reset, and that the phone got stuck on 'Pixel is starting…'. Reproducing the flow while hot-swapping the SIM tray from a locked state unexpectedly landed on the home screen, revealing the bypass.
**Exploitation:** Attacker needs only physical access: swap in their own PIN-locked SIM (whose PUK they know), trigger the PUK reset flow, and the race dismisses the lock screen, granting full device access.
**Insight:** When a privileged action calls a stateful dismiss()/close() on a shared stack, check whether a background observer can mutate the active element between the trigger and the dismiss — a TOCTOU on UI/security-screen state, not just data.