Google says it will remove Showcase.apk from Pixel devices “out of an abundance of precaution”, after iVerify said hackers could use the dormant app to spy
'Dangerous' New Spyware Warning Issued Vinayak Guha / Android Authority : Flaw in Verizon Pixel's firmware poses serious security threat (Update: Google statement) Threads: Lauren Goode / @laurengoode : You're going to want to update your Pixel's software in the next few weeks. “The application was developed by the enterprise software company Smith Micro for Verizon as a mechanism for putting phones into a retail store demo mode—it is not Google software. … X: @grapheneos : Wired was manipulated into spreading misinformation to market Palantir and iVerify by misrepresenting a vulnerability in a disabled demo app as being a serious problem which could be exploited in the real world. They should retract the article but won't. https://www.wired.com/... @grapheneos : This is one of multiple carrier apps in the stock Pixel OS which we don't include in GrapheneOS. We were aware of it already since we had to go through them and figure out why they exist. We could embrace this fearmongering and leverage it for marketing, but we aren't dishonest. @grapheneos : GrapheneOS has gone through each of the carrier apps included on Pixel generation to determine their purpose and consequences of including or excluding them. Here it is being excluded from the new adevtool project for ProtonAOSP and GrapheneOS in 2021: https://github.com/... @grapheneos : iVerify are scammers and anyone paying them money should rapidly stop doing it and remove their malware from their devices. The real security risk is giving remote code execution on your devices to one of these sketchy EDR companies lying about their capabilities and discoveries. Artem Russakovskii / @artemr : @IsMyPhoneHacked I did some digging and the Showcase.apk app is actually called Retail Demo Mode. Pname com.customermobile.preload.vzw It is indeed present/installed on my unlocked Pixel 8 Pro. https://www.apkmirror.com/... Artem Russakovskii / @artemr : There is a new vulnerability report which states that all Pixel devices before the P9 are susceptible to being hacked through a system app called Showcase. The app was created by shitty Smith Micro developers for Verizon, but ships on every Pixel device. https://www.wired.com/... Dan Guido / @dguido : The vulnerability stems from flawed logic in the verify() method. It checks both ‘payload’ and ‘payload_gzip’ fields, but only one needs to pass verification. An attacker can exploit this by injecting a malicious ‘payload’ while keeping a valid ‘payload_gzip’. Dan Guido / @dguido : We identified several on-disk artifacts to help organizations detect if this app is on their devices, including specific files in the app's directory and SQLite databases. It may also modify certain system files. @ismyphonehacked : iVerify Discovers Severe Android Vulnerability Impacting Millions of Devices Around the World. The vulnerability leaves millions of devices susceptible to man-in-the-middle (MITM) attacks and other dangerous malware and spyware. https://iverify.io/... [image] Dan Guido / @dguido : Showcase.apk is disabled by default but can be manually enabled. Once active, it downloads a config file over HTTP. @trailofbits discovered the app's signature verification for this config is broken, and malicious configs can be provided. Dan Guido / @dguido : .@IsMyPhoneHacked uncovered a hidden Android app “Showcase.apk” pre-installed on Google Pixel phones since 2017. This old Verizon demo app can potentially lead to remote code execution on millions of Android phones. https://x.com/... @cryps1s : With our partners at @IsMyPhoneHacked, we discovered an extremely privileged and insecure third-party app baked into Android firmware. Can't be removed, extensive permissions, insecure C2, no explanation for why it was there. https://www.wired.com/... https://www.washingtonpost.com/ ... LinkedIn: Rocky Cole : 🚨 Vulnerability Disclosure 🚨 — Earlier this year, iVerify's EDR agent flagged an Android device at Palantir Technologies as unsecure … Forums: Hacker News : Debunking fake stock Pixel OS vulnerability from an EDR company r/technology : Nearly All Google Pixel Phones Exposed by Unpatched Flaw in Hidden Android App
Context & Ripple Effects
The issue centers on a Verizon-developed retail-demo component that remained preinstalled but disabled on Pixel phones, rather than core Google software. Researchers said its HTTP configuration download and signature-checking flaws could permit malicious configuration or payload delivery if the app were enabled.
Google’s precautionary removal follows a recent Pixel security patch that included an exploited zero-day, extending the company’s response from patching active device flaws to removing a questionable preloaded component. It also sits in a longer Android history of malicious-app attacks exploiting device vulnerabilities.
First-order effects
- Google will remove Showcase.apk from Pixel devices, eliminating the flagged retail-demo app as a potential attack surface for affected users.
- Verizon and Smith Micro lose a preloaded retail-demo mechanism on Pixels; Google must handle the software change despite saying it did not develop the app.
Second-order effects
- The episode raises scrutiny of carrier and retail-partner software bundled with flagship devices, especially disabled components that can still be manually activated.
- Pixel security reviews may increasingly assess preloaded apps’ update paths, network transport, and signature validation—not only vulnerabilities in Google-authored code.
Third-order effects
- If vendors treat unnecessary preloads as removable risk rather than permanent device features, Android security maintenance shifts toward tighter control of the full software supply chain across OEMs, carriers, and third-party vendors.
- The disputed characterization of the risk underscores a durable challenge: security disclosures can drive rapid remediation even when exploitability and practical impact remain contested.
The trend: Mobile-platform security is moving from reactive patching toward reducing the trusted footprint of preinstalled third-party software.