Archive — US — techcrunch
Google fixes two Android zero-day bugs actively exploited by hackers
Google fixed two actively exploited zero-day vulnerabilities in Android, one discovered by Amnesty International. These vulnerabilities allow hackers to potentially compromise devices without user interaction. Google will provide patches to partners within 48 hours, highlighting the urgency due to targeted exploitation, including attacks on activists by authorities using Cellebrite.
Key points
- Google released a security update for Android to address two zero-day vulnerabilities.
- CVE-2024-53197 was identified by Amnesty International and Benoît Sevens from Google’s Threat Analysis Group.
- The vulnerabilities have been actively exploited, including targeting a Serbian student activist.
- CVE-2024-53150 is less documented but found in the system kernel.
- The critical vulnerability can allow remote privilege escalation without user interaction.
- Google will push source code patches within 48 hours to help manufacturers distribute updates.
Why it matters
- Zero-day vulnerabilities pose an ongoing threat in cybersecurity, worsening as open-source software becomes widespread.
- The use of hacking tools by law enforcement, such as Cellebrite, has raised ethical concerns regarding privacy and digital rights.
- Targeted exploitation of cybersecurity flaws highlights the necessity of robust security practices in mobile operating systems.
With the quick response to these zero-day flaws, Google underscores the importance of securing Android devices against targeted attacks, particularly in light of increasing abuse of technology against activists.