CVE-2024-10668: Google Quick Share Auth Bypass Vulnerability

CVE-2024-10668 Overview

CVE-2024-10668 is an authentication bypass vulnerability in Google Quick Share that allows an attacker on an adjacent network to write arbitrary file types to a victim's Downloads folder without authorization. The flaw stems from a race in the deletion logic that handles unknown file types received through Payload Transfer frames. By sending two FILE-type Payload Transfer frames sharing the same payload ID, an attacker bypasses Quick Share's cleanup routine, leaving the second file persisted on disk. The vulnerability is tracked under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
An adjacent-network attacker can drop arbitrary file types into a victim's Downloads directory without user acceptance, enabling staging for subsequent execution or social-engineering attacks.

Affected Products

Google Quick Share for Windows prior to v1.0.2002.2
Google Nearby library prior to commit 5d8b9156e0c339d82d3dab0849187e8819ad92c0
Microsoft Windows hosts running vulnerable Quick Share builds

Discovery Timeline

2024-11-07 - CVE-2024-10668 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10668

Vulnerability Analysis

Google Quick Share is a peer-to-peer file transfer utility that uses the Nearby Connections protocol over Bluetooth and Wi-Fi. Transfers are structured as Payload Transfer frames, and files of type FILE are written to the recipient's Downloads folder as they arrive. Quick Share enforces an allowlist on received file types and deletes any payload that does not match an approved type after transfer completion.

The deletion logic identifies unknown payloads by payload ID and removes the matching file from disk. When an attacker sends two Payload Transfer frames of type FILE that share the same payload ID, both frames write to disk, but the cleanup routine only removes the first occurrence. The second file remains in Downloads and inherits none of the file-type restrictions Quick Share is intended to enforce.

Root Cause

The root cause is an improper file-cleanup implementation that assumes a one-to-one mapping between payload IDs and on-disk artifacts. Because the deletion path is not idempotent across duplicate payload identifiers, the second write survives the sanitization step, resulting in an unrestricted file upload condition.

Attack Vector

Exploitation requires the attacker to be within Quick Share's adjacent-network range and to initiate a Quick Share session against the target. The attacker crafts two FILE Payload Transfer frames with identical payload IDs, containing an arbitrary file type that Quick Share would normally reject. After transfer, only one file is deleted and the malicious payload persists in the victim's Downloads folder, ready for later user execution or reference by another vector. Technical details are documented in the Google Nearby pull request.

Detection Methods for CVE-2024-10668

Indicators of Compromise

Unexpected files of unusual or executable types appearing in user Downloads folders shortly after Quick Share activity
Quick Share transfer logs showing multiple Payload Transfer frames with duplicate payload IDs in a single session
Windows hosts running Quick Share versions earlier than v1.0.2002.2

Detection Strategies

Inventory endpoints for installed Quick Share versions and flag any build below 1.0.2002.2
Correlate file-creation events under %USERPROFILE%\Downloads with Quick Share process activity to identify files that were never surfaced to the user through the accept dialog
Alert on the Quick Share process writing file extensions outside its documented allowlist

Monitoring Recommendations

Enable endpoint file-system telemetry for the Downloads directory and attribute writes back to parent processes
Monitor Bluetooth and Wi-Fi Direct pairing events on Windows endpoints, especially in shared or public environments
Track outbound and inbound Nearby Connections traffic on managed corporate devices

How to Mitigate CVE-2024-10668

Immediate Actions Required

Upgrade Google Quick Share for Windows to v1.0.2002.2 or later on all affected endpoints
For custom builds of the Google Nearby library, rebase past commit 5d8b9156e0c339d82d3dab0849187e8819ad92c0
Audit user Downloads folders for unexpected file types created during recent Quick Share sessions

Patch Information

Google addressed the issue in the Nearby project through the pull request tracked at Google Nearby PR #2892. The corresponding fix is included in Quick Share for Windows v1.0.2002.2. Windows users should install the latest release from the official Quick Share distribution channel.

Workarounds

Uninstall Quick Share on endpoints where the feature is not required
Set Quick Share visibility to No one or Your devices only to prevent unsolicited transfer sessions from untrusted peers
Disable Bluetooth and Wi-Fi Direct on endpoints operating in untrusted proximity environments such as conferences or shared workspaces

bash

# Configuration example: disable Quick Share via Windows package removal
winget uninstall --id Google.QuickShare