Security News > 2022 > February > Google fixes remote escalation of privileges bug on Android

Google has released the February 2022 Android security updates, addressing two critical vulnerabilities, one being a remote escalation of privilege that requires no user interaction.

The vulnerability is tracked as CVE-2021-39675, carrying a "Critical" severity rating, and affects only Android 12, the latest version of the popular OS. These flaws are typically leveraged by sophisticated spyware vendors that independently discover and privately use zero-days in mobile operating systems.

The second critical flaw addressed by the February 2022 security update is CVE-2021-30317, which affects a closed-source component of Qualcomm, and thus only concerns Android devices that use that vendor's hardware.

As Google clarifies in the bulletin: "The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed."

The technical details about the vulnerabilities are not available at this time, as Android updates typically need several months to reach a respectable percentage of the userbase, given that vendors need to bundle them separately for each device model.

Finally, the fixes that come with this month's update concern Android 10, 11, and 12, so if your phone runs anything older than that, you are no longer covered, and you should consider your device a security liability.

News URL

https://www.bleepingcomputer.com/news/security/google-fixes-remote-escalation-of-privileges-bug-on-android/