Google Pixel 6a (GX7AS)

Google Pixel 6a (GX7AS)
Security Grade B Calculator v	Google Pixel 6a Brand: Google Category: Smartphone • Model / Gen: Pixel 6 series GX7AS (US/Canada sub-6 GHz variant) Release Date: 2022-07-28 • Status: Classification Date: • Official Website

Security Evaluation

1. Device Security

Criterion	Value	Proof	Comment
Known hardware tampering	Rare	🔗 Proof	iFixit demonstrates opening the Pixel 6a, removing its midframe, disconnecting its battery and replacing internal parts. This establishes physical modification under the methodology's broad definition, which includes removing parts. Rare is a provisional qualitative mapping, not an observed incident rate. A repair procedure does not demonstrate bypassing Titan M2, decrypting user data, or a malicious hardware attack.
Known vulnerabilities	Very common	🔗 Proof	CERT-In advisory CIVN-2024-0191 explicitly lists Pixel 6a among affected devices and documents numerous firmware vulnerabilities across several components. This supports a substantial historical vulnerability record. Very common is a qualitative mapping of that record, not a measured prevalence rate. The advisory recommends Google updates; these historical findings do not mean that an updated phone remains vulnerable to every listed issue.
Prior attacks	Rare	🔗 Proof	The USENIX Security 2025 TapTrap paper documents attacks in a 20-participant study using a Pixel 6a running Android 15 (section 7.2). This is model-specific experimental exploitation, not proof of widespread criminal use or botnet membership. The authors found no evidence of TapTrap exploitation in their sampled apps. Rare is provisional; real-world incident frequency and applicability to the latest patched build remain unverified.
Updatability	Very common	🔗 Proof	Google explicitly includes Pixel 6a in its five-year OS and security update policy and describes regular software updates. With July 2022 first availability, the stated support period extends to July 2027. The Pixel bulletin archive documents recurring security releases. This rates documented update availability, not whether a particular owner installed them; carrier and device rollout timing may vary.
Category Score	Score: 2 / 3

2. System Security

Criterion	Value	Proof	Comment
Authentication with other systems	Partial	🔗 Proof	The Android 14 Security Target includes GX7AS and documents TLS server validation, optional TLS client certificates, Bluetooth pairing and EAP-TLS. Mutual authentication depends on protocol and configuration; it is not mandatory for every application connection. Partial reflects this documented distinction (sections 6.2 and 6.4).
Communications	No encryption	🔗 Proof	Android supports HTTPS/TLS and blocks cleartext by default for apps targeting Android 9 or later, but explicitly permits application opt-in to unencrypted HTTP. Score 3 conservatively represents the documented availability of plaintext communication in this general-purpose device, not a claim that all traffic is unencrypted. The rubric has no mixed-encryption option; obsolete encryption would misdescribe this limitation. No packet capture of a particular handset was performed.
Storage	Encrypted with up-to-date encryption	🔗 Proof	The Android 14 Security Target explicitly includes Pixel 6a GX7AS. Section 6.3 documents AES-256-XTS encryption of the internal-flash user-data partition, including application data. This score covers protected data at rest; it does not claim encryption of every firmware byte or enterprise-only sensitive-data features.
Category Score	Score: 2 / 3

3. User Authentication

Criterion	Value	Proof	Comment
Account management	Full	🔗 Proof	Google documents creating, switching and deleting separate Pixel user profiles, each with its own accounts, apps and settings. The owner can manage other users and their call permissions; guest access is separate. Screen-lock credentials can be changed after current-credential verification. These functions meet the rubric's account lifecycle and lower-privilege criteria; this does not imply arbitrary enterprise role-based access control.
Authentication	Secure	🔗 Proof	Google documents ownership verification after resetting a protected Pixel, using the existing screen lock or a previously synced Google account. Protection requires adding an account and setting a screen lock. The Android 14 Security Target also documents verified software updates. Secure rates these available recovery and integrity controls with the bootloader locked; it does not assert that an unconfigured or deliberately unlocked handset has equivalent protection.
Brute-force protection	Exist	🔗 Proof	The Pixel 6a is explicitly covered by the Android 14 Security Target. Section 6.4 documents Gatekeeper retry throttling and failed-attempt tracking, plus fingerprint lockout and password fallback. These are positive protections when a screen lock is configured; no enterprise-managed automatic wipe is assumed.
Event logging	Partial logging	🔗 Proof	Google documents a privacy dashboard showing which applications accessed permissions and when. This provides a positive basis for partial access logging. It does not establish a complete, durable audit of every login, connection or file access on an unmanaged Pixel 6a. Broader managed-device auditing exists in the Android 14 Security Target, but it is not assumed enabled for a normal consumer installation.
Passwords	Default/Common/Easy to guess	🔗 Proof	Google permits None or Swipe, a four-digit PIN, a pattern, or a password with four or more characters. Stronger choices are available but consumer setup does not universally enforce the rubric's change-and-complexity requirements. Score 3 represents the documented weak/no-lock choices, not a shared factory password. Enterprise-enforced policies can improve this behavior and are outside the assumed consumer configuration.
Category Score	Score: 2 / 3

Technical Specifications

Property	Details
Operating System & App	Android (launched with Android 12; Android 14 security documentation used as a versioned baseline) (Companion App: )
Hardware (CPU / GPU)	CPU: Google Tensor; Titan M2 security coprocessor • GPU:
Memory & Storage	Memory: 6 GB LPDDR5 RAM • Storage: 128 GB UFS 3.1
Power, Battery & Charging	Battery: 4410 mAh typical; 4306 mAh minimum • Power: Rechargeable battery; USB-C power • Charging: Wired charging up to 18 W; USB PD 3.0 PPS compatible
Display & Camera	Display: 6.1-inch OLED, 1080 x 2400, up to 60 Hz • Camera: Rear: 12.2 MP wide + 12 MP ultrawide; front: 8 MP
Sound & Connectivity	Sound: Stereo speakers; two microphones • Connectivity: 5G sub-6 GHz, LTE, Wi-Fi 6/6E (regional limits), Bluetooth 5.2, NFC, USB-C 3.1 Gen 1; nano-SIM + eSIM
Physical (Dimensions & Mass)	Dimensions: 152.2 x 71.8 x 8.9 mm • Mass: 178 g

Assessment scope and limitations

• Evidence reviewed on 2026-10-23. This is a literature-based assessment of Google Pixel 6a (GX7AS), not a penetration test or a certification of a particular handset.
• The Android 14 Security Target is a dated implementation reference explicitly listing GX7AS. Its managed/evaluated configuration is not assumed to be the default consumer configuration, and its certification is not extended to later Android versions. Later security history is dated separately.
• Storage evaluates protected user/application data in internal flash. Communication evaluates whether plaintext paths are possible. Authentication and brute-force ratings credit documented controls with a configured screen lock, Google account and locked bootloader; Passwords separately records that weak or absent locks are permitted.
• The site provides no Unknown option and no numeric thresholds for Rare/Very common. Hardware and prior-attack frequency are therefore provisional qualitative mappings. Physical repair is not a security bypass. TapTrap is laboratory/user-study exploitation; criminal incident frequency and current patch applicability have not been established.
• Sale status, a separate GPU specification, and a required companion app were not established in the selected primary material, so those fields are left blank. Unknown is not treated as absent.
• Duplicate check: the full Pixel title list and exact "Pixel 6a" search returned no Pixel 6a classification on 2026-10-23. Pixel 6 is a different model.

Additional evidence

• Google hardware specifications: Pixel 6a section, GX7AS variant
• Google launch availability: July 28, 2022
• Pixel security bulletin archive
• Google user and guest privileges
• Google screen-lock credential changes and permitted choices
• Google Android 14 Security Target: model table; sections 6.2-6.4 and 6.6

Score calculation

• Device: ceil((2 + 3 + 2 + 1)/4) = 2.
• System: ceil((2 + 3 + 1)/3) = 2.
• User authentication: ceil((1 + 1 + 1 + 2 + 3)/5) = 2.
• Total: 6, corresponding to B under the current Methodology. This is a device-danger rating, not an assignment mark.