Google addressed 3 actively exploited flaws in Android

Google released July security updates for Android that addressed tens of vulnerabilities, including three actively exploited flaws.

July security updates for Android addressed more than 40 vulnerabilities, including three flaws that were actively exploited in targeted attacks.

“There are indications that the following may be under limited, targeted exploitation.” reads the security bulletin.

CVE-2023-26083
CVE-2021-29256
CVE-2023-2136

The CVE-2023-26083 is an Arm Mali GPU kernel driver information disclosure vulnerability that the US CISA added to its Known Exploited Vulnerabilities catalog in April 2023.

The CVE-2023-26083 is chained with other issues to install commercial spyware, as reported by Google’s Threat Analysis Group (TAG) in a recent report.

The second actively exploited flaw addressed by Google is a high-severity issue, tracked as CVE-2021-29256, that affects specific versions of the Bifrost and Midgard Arm Mali GPU kernel drivers. An unprivileged user can exploit the flaw to gain unauthorized access to sensitive data and escalate privileges to the root.

The third actively exploited flaw is a critical integer overflow in Skia, which is a Google’s open-source multi-platform 2D graphics library. The flaw was reported by Clément Lecigne of Google’s Threat Analysis Group on 2023-04-12.

A remote attacker who has taken over the renderer process can trigger the flaw escape the sandbox and execute arbitrary code on Android devices.

Google released two patch levels, the first one released on July 1 addressed 22 vulnerabilities in the Framework and System components.

The second patch level, released on July 5, fixed 20 vulnerabilities in the kernel and closed source components.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Android)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.