WARNING: A New Android Zero-Day Vulnerability Is Under Active Attack

Cyber Security

Google has disclosed that a now-patched vulnerability affecting Android devices that use Qualcomm chipsets is being weaponized by attackers to launch targeted attacks.

Tracked as CVE-2020-11261 (CVSS score 8.4), the flaw concerns an “improper input validation” issue in Qualcomm’s Graphics component that could be exploited to trigger memory corruption when an attacker-engineered app requests access to a huge chunk of the device’s memory.

“There are indications that CVE-2020-11261 may be under limited, targeted exploitation,” the search giant said in an updated January security bulletin on March 18.

CVE-2020-11261 was discovered by Google’s Android Security team on July 20, 2020, and reported to Qualcomm, after which it was fixed in January 2021.

It’s worth noting that the access vector for the vulnerability is “local,” meaning that exploitation requires local access to the device. In other words, to launch a successful attack, the bad actor must either have physical access to the vulnerable smartphone or use other means – e.g., a watering hole – to deliver malicious code and set off the attack chain.

While specifics about the attacks, the identity of the attacker, and the targeted victims have not been released, it is not unusual for Google to withhold sharing such information to prevent other threat actors from taking advantage of the vulnerability.

If anything, the development once again underscores the need to promptly install monthly security updates as soon as they are available to prevent Android devices from being exploited. We’ve reached out to Google for comment and will update this article if we hear back.

Articles You May Like

Samsung Galaxy A71 5G Gets Android 13-Based One UI 5.0 Update: Report
Meta Allows Quest VR Headset Usage Without Facebook Account As Firm Bows to German Regulator
Nothing Phone 1 Gets New Update With November 2022 Security Patch, AirPods Battery Percentage Display, More
Twitter Rival Koo Gets Over 1 Million Downloads Within 48 Hours of Launch in Brazil
Tech’s reality check: How the industry lost $7.4 trillion in one year