r/VolvoRecharge

I am looking for owners of recent Volvo and Polestar models, seeking help to better characterize a security vulnerability that I found while digging into the software stack of my own car, a Volvo EX30. Before I make the responsible disclosure to Volvo Cars, I'd like to confirm whether it affects other models as well.

This is where I need some help: I need access to the software running on the AAOS (Android Automotive OS) infotainment systems of potentially affected models. Of course only the system part of the head unit, nothing that is individual to a vehicle (device/vehicle ID, user generated data, etc.).

The particular brands/models I'm interested in:

• all Volvo Cars models that use AAOS ins their infotainment system (vehicles made in the last 3-5 years or even older models that might have gotten it as an upgrade)
• all Polestar models that use AAOS in their infotainment system (vehicles made in the last 5-6 years)

I suspect that the issue predates the arrival of AAOS, but I'm not really familiar with the Sensus architecture. Still, if somebody has a file system dump from an older Sensus infotainment system, I'd like to take a look at it too.

Here's what I need:

• a dump of parts of the file system like /product, /system, /system_ext, /vendor, etc. (or an OTA update package, i.e. *.VBF files)
• name of the vehicle model
• model year
• software version

I also wrote a non-instrusive app that can extract a file system dump from an AAOS device (of course not everything, just what any 3rd party app can read), it's available on GitHub. You can compile it yourself or I can give access to my Google Play Internal Testing track.

I'll not give away any details about the vulnerability itself before I gave Volvo a chance to fix it, so don't even ask.

If somebody is willing to help with this, I wrote a more lengthy page about the system dumper app, my motivation, myself (I don't try to hide my identity) and how you can contact me.

Of course I understand that anybody could write this with malicious intent in mind. I don't think there's much more I could do to convince people that my intentions are honest. If I don't get useful feedback/help, I'll just hand in (to Volvo Cars) what I know about the EX30 and hope they'll actually fix it. The worst that could happen is that they do an ineffective fix for the EX30, they don't fix any other models (claiming that they are not affected by the issue and I cannot prove them wrong) and in reality they all remain vulnerable and somebody with malicious intent starts working on this. In that scenario there's still the option to involve regional authorities (US, EU, etc.) and the media. Both can exercise the necessary pressure to make an actual fix happen (there has been precedent with models from other automakers).

I purchased my ‘22 XC60 T8 in May ‘24 as CPO. The ERAD died in June with about 50k miles on the odometer. Volvo has no ETA for replacement ERAD for my MY. Why? How can you sell CPO and not be prepared for this after years of knowing the fault in the part? Why no recall?

I’ve read anecdotes online of Volvo working on an updated replacement part but neither Volvo USA or the dealership service department that has my car has said anything about this. Why?

I’ve also read that Volvo is encouraging dealerships to provide long-term loaners. Mine was generous for a few months then kicked me into an Enterprise rental no more than $40 a day - a Jeep Compass that smells like Febreeze and cigarettes. Hardly comparable and the least of my concerns - but why?

It seems we need to start talking about a class action suit around here.

My partner and I both just purchased 2026 XC90 T8 ultras in August. The cars are essentially identical other than color. When my battery is fully charged, it says 34 miles for the range. When his is fully charged it says 42. Can anyone explain why there is a discrepancy? I have definitely used my battery more as I have more opportunity to charge it. But the cars are two months old…I don’t understand why there is an 8 mile discrepancy. Is there something wrong with mine? Appreciate any input on this, thanks.

According to the Volvo XC40 docs (EDIT: removed hyperlink) see FAQ PDF at the bottom of the docs), Connect Plus includes Google Assistant among other features like live updates to Google Maps.

What features are included under Google Assistant? Climate control voice commands?

Beyond what is listed in the docs, I'm trying to determine what features will be lost if I allow a Connect Plus subscription to lapse.

From the FAQ #6 (emphasis mine)

>What features stop working if the car is not connected?
A: Without Connect Plus, the vehicle still supports built-in features such as some offline navigation, phone calls, and radio or locally stored media. However, the following features will be unavailable: real-time traffic and online navigation in Google Maps, Google Assistant, and Google Play and in-car app downloads

Edit: more FAQs

>5. Will the Volvo Cars app still work if I don’t have Connect Plus?
A: Yes. Core Volvo Cars app features—such as remote start and vehicle status—will continue to function normally without an active Connect Plus subscription.

Hi, 2021 XC40 Recharge here. There is a creak noise coming from somewhere in the center console. Mostly happens over bumps and turning. It sounds like it‘s the finishes and not a mechanical problem. Has anyone else had this problem? Have you had it fixed? It doesn’t bother me but it’s embarrassing to have someone else in my really nice Volvo and it sounds so bad.