Google released September 2023 Android security updates that address tens of vulnerabilities, including a zero-day flaw tracked as CVE-2023-35674 that was actively exploited in the wild.
This high-severity vulnerability CVE-2023-35674 resides in the Framework component, a threat actor could exploit the issue to escalate privileges without requiring user interaction or additional execution privileges.
“There are indications that CVE-2023-35674 may be under limited, targeted exploitation.” reads the advisory published by Google.
The company also addressed three critical remote code execution vulnerabilities, tracked as CVE-2023-35658, CVE-2023-35673, CVE-2023-35681, in the System component.
“The most severe vulnerability in this section could lead to remote (proximal/adjacent) code execution with no additional execution privileges needed. User interaction is not needed for exploitation.” continues the advisory.
The IT giant also addressed another critical remote code execution vulnerability, tracked as CVE-2023-28581, that affects Qualcomm closed-source components.
In total, Google has fixed 6 flaws in the Framework module, 14 in the Kernel componet, 3 issues in the Qualcomm components, and 9 issues in the Qualcomm closed-source components.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Google)
A data breach at Ascension, caused by a former partner's compromise, exposed the health information…
Law enforcement dismantled a 20-year botnet behind Anyproxy and 5socks cybercriminals services and arrested four…
A cyberattack briefly disrupted South African Airways' website, app, and systems, but core flight operations…
The FBI warns that attackers are using end-of-life routers to deploy malware and turn them…
Since early 2025, Russia-linked ColdRiver has used LostKeys malware to steal files in espionage attacks…
SonicWall addressed three SMA 100 flaws, including a potential zero-day, that could allow remote code…
This website uses cookies.
