Google warns of critical android security vulnerabilities

Google has shipped patches for two zero-day Android security flaws, which were exploited by hackers. These flaws expose many millions of users to danger as they can be exploited remotely by hackers without even any user involvement . One of the vulnerabilities, also referred to as CVE-2024-53197, was unearthed by Google's Threat Analysis Group (TAG) and Amnesty International. The vulnerability had been exploited in a targeted attack against Serbian student activist Filip Subasic by the alleged use of local authorities leveraging Cellebrite tools. 

Second bug uncovered in android kernel

The second vulnerability, CVE-2024-53150, was likewise uncovered by Google's TAG. It resides in the kernel, the coremost layer of the Android operating system, and might have a disastrous impact if abused inappropriately.

No user action needed to be hacked

The most important issue permits the attackers to remotely access and control without needing special permissions or any user input. This implies that a hacker can take advantage of the vulnerability without the user even pressing anything, greatly amplifying the threat.

Google delayed public patch rollout

Although Google has alerted its Android partners to these issues, the openness of Android is such that each vendor must install patches themselves. This can put tens of millions of users in jeopardy for weeks or even months.