Google Pixel 7a (GWKK3)

From Wiki-IoT



Google Pixel 7a (GWKK3)
Security Grade
   
     B
Calculator v1
Google Pixel 7a
   Brand: Google 

   Category: Smartphone • Model / Gen: Pixel 7 series GWKK3 (5G sub-6 GHz variant)

   Release Date: 2023-05-10 • Status: 

   Classification Date: 2026-10-25 • Official Website

Security Evaluation

1. Device Security

Criterion Value Proof Comment
Known hardware tampering Rare 🔗 Proof ChoiceJacking (USENIX Security 2025, table 1 and section 6.7) demonstrates a malicious charger attacking the exposed USB connection of a Pixel 7a running Android 14. This fits the methodology's physical-port scope. The reported Pixel attacks require an unlocked phone; ADB access additionally requires USB debugging enabled. Rare is a provisional qualitative rating for a demonstrated method, not a measured attack rate or a claim of hardware-chip compromise.
Known vulnerabilities Very common 🔗 Proof CERT-In advisory CIVN-2024-0191 explicitly lists Pixel 7a among affected devices and documents numerous firmware vulnerabilities across several components. This supports a substantial historical vulnerability record. Very common is a qualitative mapping of that record, not a measured prevalence rate. The advisory recommends Google updates; these historical findings do not mean that an updated phone remains vulnerable to every listed issue.
Prior attacks Rare 🔗 Proof ChoiceJacking documents successful laboratory exploitation on Pixel 7a (Android 14), including MTP file access and, with USB debugging enabled, ADB access. This is evidence of a performed attack rather than merely a theoretical vulnerability. It does not establish botnet participation or criminal prevalence. Rare is provisional; real-world frequency and behavior on the latest patched build remain unverified. The paper does not identify the regional SKU tested.
Updatability Very common 🔗 Proof Google explicitly includes Pixel 7a in its five-year OS and security update policy and describes regular software updates. Its May 2023 availability implies support through May 2028 under that policy. The Pixel bulletin archive documents recurring releases. This rates update availability, not installation on a particular phone; timing can vary by carrier and device. Older launch material promised fewer OS upgrades, so the current policy is used.
Category Score Score: 2 / 3

2. System Security

Criterion Value Proof Comment
Authentication with other systems Partial 🔗 Proof The Android 14 Security Target includes GWKK3 and documents TLS server validation, optional TLS client certificates, Bluetooth pairing and EAP-TLS. Mutual authentication depends on protocol and configuration; it is not mandatory for every application connection. Partial reflects this documented distinction (sections 6.2 and 6.4).
Communications No encryption 🔗 Proof Android supports HTTPS/TLS and blocks cleartext by default for apps targeting Android 9 or later, but explicitly permits application opt-in to unencrypted HTTP. Score 3 conservatively represents the documented availability of plaintext communication in this general-purpose device, not a claim that all traffic is unencrypted. The rubric has no mixed-encryption option; obsolete encryption would misdescribe this limitation. No packet capture of a particular handset was performed.
Storage Encrypted with up-to-date encryption 🔗 Proof The Android 14 Security Target explicitly includes Pixel 7a GWKK3. Section 6.3 documents AES-256-XTS encryption of the internal-flash user-data partition, including application data. This score covers protected data at rest; it does not claim encryption of every firmware byte or enterprise-only sensitive-data features.
Category Score Score: 2 / 3

3. User Authentication

Criterion Value Proof Comment
Account management Full 🔗 Proof Google documents creating, switching and deleting separate Pixel user profiles, each with its own accounts, apps and settings. The owner can manage other users and their call permissions; guest access is separate. Screen-lock credentials can be changed after current-credential verification. These functions meet the rubric's account lifecycle and lower-privilege criteria; this does not imply arbitrary enterprise role-based access control.
Authentication Secure 🔗 Proof Google documents ownership verification after resetting a protected Pixel, using the existing screen lock or a previously synced Google account. Protection requires adding an account and setting a screen lock. The Android 14 Security Target also documents verified software updates. Secure rates these available recovery and integrity controls with the bootloader locked; it does not assert that an unconfigured or deliberately unlocked handset has equivalent protection.
Brute-force protection Exist 🔗 Proof The Pixel 7a is explicitly covered by the Android 14 Security Target. Section 6.4 documents Gatekeeper retry throttling and failed-attempt tracking, plus fingerprint lockout and password fallback. These are positive protections when a screen lock is configured; no enterprise-managed automatic wipe is assumed.
Event logging Partial logging 🔗 Proof Google documents a privacy dashboard showing which applications accessed permissions and when. This provides a positive basis for partial access logging. It does not establish a complete, durable audit of every login, connection or file access on an unmanaged Pixel 7a. Broader managed-device auditing exists in the Android 14 Security Target, but it is not assumed enabled for a normal consumer installation.
Passwords Default/Common/Easy to guess 🔗 Proof Google permits None or Swipe, a four-digit PIN, a pattern, or a password with four or more characters. Stronger choices are available but consumer setup does not universally enforce the rubric's change-and-complexity requirements. Score 3 represents the documented weak/no-lock choices, not a shared factory password. Enterprise-enforced policies can improve this behavior and are outside the assumed consumer configuration.
Category Score Score: 2 / 3

Technical Specifications

Property Details
Operating System & App Android (launched with Android 13; Android 14 security documentation used as a versioned baseline) (Companion App: )
Hardware (CPU / GPU) CPU: Google Tensor G2; Titan M2 security coprocessor • GPU:
Memory & Storage Memory: 8 GB LPDDR5 RAM • Storage: 128 GB UFS 3.1
Power, Battery & Charging Battery: 4385 mAh typical; 4300 mAh minimum • Power: Rechargeable battery; USB-C power • Charging: Wired charging up to 18 W; Qi-certified wireless charging
Display & Camera Display: 6.1-inch OLED, 1080 x 2400, up to 90 Hz • Camera: Rear: 64 MP wide + 13 MP ultrawide; front: 13 MP
Sound & Connectivity Sound: Stereo speakers; two microphones • Connectivity: 5G sub-6 GHz, LTE, Wi-Fi 6E (regional limits), Bluetooth 5.3 + LE, NFC, USB-C 3.2 Gen 2; nano-SIM + eSIM
Physical (Dimensions & Mass) Dimensions: 152 x 72.9 x 9.0 mm • Mass: 193.5 g


Assessment scope and limitations

  • Evidence reviewed on 2026-10-23. This is a literature-based assessment of Google Pixel 7a (GWKK3), not a penetration test of a particular handset.
  • The Android 14 Security Target explicitly lists GWKK3 and is used as a dated implementation reference. Enterprise policies and the complete evaluated configuration are not assumed to be consumer defaults. Its certification is not extended to later Android versions.
  • Storage evaluates protected user/application data in internal flash. Communication evaluates whether plaintext paths are possible. Authentication and brute-force ratings credit documented controls with a configured screen lock, Google account and locked bootloader; Passwords separately records that weak or absent locks are permitted.
  • Hardware and prior-attack evidence comes from ChoiceJacking, a laboratory study on Pixel 7a running Android 14. Its regional SKU is unspecified. The paper demonstrates USB attacks under stated conditions; it does not establish a locked-Pixel bypass, widespread criminal exploitation, or vulnerability of every current build.
  • The site provides no Unknown option and no numeric thresholds for Rare/Very common. Frequency ratings are provisional qualitative mappings. Unknown incidence is not treated as proof that attacks are absent. The same study supports two distinct criteria (physical-port exposure and a performed attack), not two separate incidents.
  • Sale status, a separate GPU specification, and a required companion app were not established in the selected primary material and are left blank. Lack of evidence is not treated as absence.
  • Duplicate check: the full Pixel title list and exact "Pixel 7a" search returned no Pixel 7a classification on 2026-10-23. Pixel 7 and Pixel 7 Pro are different models.

Additional evidence

Score calculation

  • Device: ceil((2 + 3 + 2 + 1)/4) = 2.
  • System: ceil((2 + 3 + 1)/3) = 2.
  • User authentication: ceil((1 + 1 + 1 + 2 + 3)/5) = 2.
  • Total: 6, corresponding to B under the current Methodology. This is a device-danger rating, not an assignment mark.
Retrieved from "http://fehmijaafar.net/wiki-iot/index.php?title=Google_Pixel_7a_(GWKK3)&oldid=10330"