Google addressed an actively exploited zero-day in Android

Google released September 2023 Android security updates to address multiple flaws, including an actively exploited zero-day.

Google released September 2023 Android security updates that address tens of vulnerabilities, including a zero-day flaw tracked as CVE-2023-35674 that was actively exploited in the wild.

This high-severity vulnerability CVE-2023-35674 resides in the Framework component, a threat actor could exploit the issue to escalate privileges without requiring user interaction or additional execution privileges.

“There are indications that CVE-2023-35674 may be under limited, targeted exploitation.” reads the advisory published by Google.

The company also addressed three critical remote code execution vulnerabilities, tracked as CVE-2023-35658, CVE-2023-35673, CVE-2023-35681, in the System component.

“The most severe vulnerability in this section could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.” continues the advisory.

The IT giant also addressed another critical remote code execution vulnerability, tracked as CVE-2023-28581, that affects Qualcomm closed-source components.

In total, Google has fixed 6 flaws in the Framework module, 14 in the Kernel componet, 3 issues in the Qualcomm components, and 9 issues in the Qualcomm closed-source components.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Google)