Google addressed 3 actively exploited flaws in Android

Google released July security updates for Android that addressed tens of vulnerabilities, including three actively exploited flaws.

July security updates for Android addressed more than 40 vulnerabilities, including three flaws that were actively exploited in targeted attacks.

“There are indications that the following may be under limited, targeted exploitation.” reads the security bulletin.

The CVE-2023-26083 is an Arm Mali GPU kernel driver information disclosure vulnerability that the US CISA added to its Known Exploited Vulnerabilities catalog in April 2023.

The CVE-2023-26083 is chained with other issues to install commercial spyware, as reported by Google’s Threat Analysis Group (TAG) in a recent report.

The second actively exploited flaw addressed by Google is a high-severity issue, tracked as CVE-2021-29256, that affects specific versions of the Bifrost and Midgard Arm Mali GPU kernel drivers. An unprivileged user can exploit the flaw to gain unauthorized access to sensitive data and escalate privileges to the root.

The third actively exploited flaw is a critical integer overflow in Skia, which is a Google’s open-source multi-platform 2D graphics library. The flaw was reported by Clément Lecigne of Google’s Threat Analysis Group on 2023-04-12.

A remote attacker who has taken over the renderer process can trigger the flaw escape the sandbox and execute arbitrary code on Android devices.

Google released two patch levels, the first one released on July 1 addressed 22 vulnerabilities in the Framework and System components.

The second patch level, released on July 5, fixed 20 vulnerabilities in the kernel and closed source components.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Android)