Google promises a rescue patch for Android 14’s “ransomware” bug

So Android 14 has this pretty horrible storage bug for upgrading users. If you have multiple user accounts on your device, upgrading to Android 14 can actually lock you out of the device's local storage, which creates an incredible number of problems that are all pretty similar to getting hit with device-encrypting "ransomware" malware. Bugs are always going to happen, but the big problem with this is that Google has seemingly been ignoring it, and on Friday we wrote about how users have been piling up hundreds of reports for 10 days without an acknowledgement or fix promised by Google.

Apparently one more round of news reports was enough to get the gears moving at Google. Over the weekend the Issue tracker bug has been kicked up from a mid-level "P2" priority to "P0," the highest priority on the issue tracker. The bug has been assigned to someone now, and Googlers have jumped into the thread to make official statements that Google is looking into the matter. Here's the big post from Google on the bug tracker:

We are aware of an issue occurring on some Pixel devices (Pixel 6 and later models) that have both received the Android 14 update and have multiple users (other than the primary user) set up. Multiple users include users, guests, restricted profiles, and child users. However, it does not include having more than one Google account within the primary user or work profiles.

 

Depending on the device, this issue can result in the primary user being unable to access media storage. Alternatively, the issue can reboot the device with a “Factory data reset” message. If this message is accepted, data that is not backed up can be lost, and if it is declined, the device repeatedly reboots with the “Pixel is starting” message.

 

We’re continuing to work on fixes for impacted devices, and have already pushed out a Google Play system update that will help prevent this issue from being triggered on additional devices. To check if a Google Play system update is available for your device, follow the instructions in this Help Center article.

 

If you’re experiencing this issue: If your impacted device is unable to access media storage, we anticipate a system update will repair the issue and restore access to media files without requiring a factory reset. If your device is stuck in a "Pixel is starting" boot loop due to this issue, we are investigating methods that may be able to recover some data. We’ll provide more information as soon as it is available.

 

For users who are not experiencing this issue, or have already factory reset their device, we recommend avoiding creating or logging into a secondary user on the device until the OTA update is available.

 

We're sorry for the inconvenience this has caused, and we appreciate your patience.

The highlights here are that Google says the bug affects devices with multiple Android users, not multiple Google accounts or (something we thought originally) users with work profiles. Setting up multiple users means going to the system settings, then "Multiple users," then "Allow multiple users," and you can add a user other than the default one. If you do this, you'll have a user switcher at the bottom of the quick settings. Multiple users all have separate data, separate apps, and separate Google accounts. Child users are probably the most popular reason to use this feature, since you can lock kids out of things like purchasing apps.

Shipping a Google Play system update as a quick band-aid is an interesting solution, but as Google's post suggests, this doesn't mean the problem is fixed. Play system updates (these are alternatively called Project Mainline or APEX modules) allow Google to update core system components via the Play Store, but they are really not meant for critical fixes. The big problem is that the Play system updates don't aggressively apply themselves or even let you know that they have downloaded. They just passively, silently wait for a reboot to happen so they can apply. For Pixel users it feels like the horse has already left the barn anyway—like most Pixel phones have automatically applied the ~13-day-old update by now.

Users can force Play system updates to happen themselves by going to the system settings, then "Security & Privacy," then "System & updates," then "Google Play system update." If you have an update, you'll be prompted to reboot the phone. Also note that this is totally different from the usual OS update checker location, which is in system settings, then "System," then "System update." The system update screen will happily tell you "Your system is up to date" even if you have a pending Google Play system update. It would be really great to have a single location for OS updates, Google Play System/Mainline updates, and app updates, but they are scattered all over the place and give conflicting "up to date" messages.

Finally, it's really good news that Google has a solution in the works for people who have already been locked out of their devices. A factory reset has always been a solution that fixes the problem, but that will also erase all your data, and some people understandably don't want to do that. For people stuck in a "Pixel is starting" boot loop, Google sounds a bit sketchier, with Google planning a fix that will recover "some" data.

We'll let you know when any of these fixes come out. Google had better get to work quickly, as some Android partners are already rolling out Android 14 to a much wider audience. Samsung is rolling out Android 14 to the S23 in some regions today, and we really have no idea if this affects Samsung phones or not. Getting started on all of this 10 days ago probably would have helped.