Every Google Pixel Phone Has a Verizon App that Doubles As a Backdoor

A preinstalled, unremovable demo application named "showcase.apk" included in Google Pixel phones since 2017 possesses excessive system-level privileges and insecure network/update behavior (communicates with a C2 over HTTP and has weak verification), enabling potential persistent, undetectable device control (camera, messages, package installation). iVerify found the issue and reported that activation required physical proximity in their tests; there is no evidence of in-the-wild exploitation, Google is preparing a fix and Pixel 9 will omit the package.