Google released an Android update on Monday that resolves two zero-day bugs that “may be under limited, targeted exploitation,” as the company phrased it. That suggests Google is aware that hackers have and may continue to use the bugs to infect Android devices in real-world circumstances.
Amnesty International found one of the two now-fixed zero-days, tracked as CVE-2024-53197, in partnership with Benoît Sevens of Google’s Threat Analysis Group, the tech giant’s security division that analyzes government-backed cyberattacks. line by 75 days.
In February, Amnesty International discovered that Cellebrite, a firm that provides equipment to law enforcement for unlocking and forensically analyzing phones, was using a series of three zero-day vulnerabilities to hack into Android phones.
In this case, Amnesty discovered vulnerabilities, including one patched on Monday, that were being utilized against a Serbian student activist by local police armed with Cellebrite.
There isn’t much information available about the second vulnerability, CVE-2024-53150, which was patched on Monday, other than the fact that it was discovered by Google’s Sevens and that the bug was located in the kernel, an operating system’s core.
Google did not immediately respond to a request for comment.
Amnesty representative Hajira Maryam stated that the organization did not have anything to report at this time.
According to the tech giant’s alert, “the most severe of these issues is a critical security vulnerability in the System component that could lead to remote escalation of privilege with no additional execution privileges needed,” which means that “user interaction is not needed for exploitation.”
Google stated that it will release source code updates for the two corrected zero-days within 48 hours following the advisory, and that Android partners are “notified of all issues at least a month before publication.”
Given Android’s open source nature, every phone manufacturer must now distribute patches to their own consumers.
This item has been amended to reflect Amnesty’s response.
