Security News > 2021 > November > Google Warns of New Android 0-Day Vulnerability Under Active Targeted Attacks

Google has rolled out its monthly security patches for Android with fixes for 39 flaws, including a zero-day vulnerability that it said is being actively exploited in the wild in limited, targeted attacks.

Tracked as CVE-2021-1048, the zero-day bug is described as a use-after-free vulnerability in the kernel that can be exploited for local privilege escalation.

"There are indications that CVE-2021-1048 may be under limited, targeted exploitation," the company noted in its November advisory without revealing technical details of the vulnerability, the nature of the intrusions, and the identities of the attackers that may have abused the flaw.

Also remediated in the security patch are two critical remote code execution vulnerabilities - CVE-2021-0918 and CVE-2021-0930 - in the System component that could allow remote adversaries to execute malicious code within the context of a privileged process by sending a specially-crafted transmission to targeted devices.

Two more critical flaws, CVE-2021-1924 and CVE-2021-1975, affect Qualcomm closed-source components, while a fifth critical vulnerability in Android TV could permit an attacker in close proximity to silently pair with a TV and execute arbitrary code with no privileges or user interaction required.

CVE-2020-11261 - Improper input validation in Qualcomm Graphics component.

News URL

https://thehackernews.com/2021/11/google-warns-of-new-android-0-day.html