Cybersecurity

Google Warns of Actively Exploited CVE-2024-43093 Vulnerability in Android System

Google has warned that a security flaw impacting its Android operating system has come under active exploitation in the wild.

The vulnerability, tracked as CVE-2024-43093, has been described as a privilege escalation flaw in the Android Framework component that could result in unauthorized access to “Android/data,” “Android/obb,” and “Android/sandbox” directories and its sub-directories, according to a code commit message.

There are currently no details about how the vulnerability is being weaponized in real-world attacks, but Google acknowledged in its monthly bulletin that there are indications it “may be under limited, targeted exploitation.”

The tech giant has also flagged CVE-2024-43047, a now-patched security bug in Qualcomm chipsets, as having been actively exploited. A use-after-free vulnerability in the Digital Signal Processor (DSP) Service, a successful exploitation of the security flaw could lead to memory corruption.

Cybersecurity

Last month, the chipmaker credited Google Project Zero researcher Seth Jenkins and Conghui Wang for reporting the flaw, and Amnesty International Security Lab for confirming the in-the-wild activity.

The advisory offers no details on the exploit activity targeting the flaw or when it might have started, although it’s possible that it may have been leveraged as part of highly targeted spyware attacks aimed at civil society members.

It’s also currently not known if both the security vulnerabilities were fashioned together as an exploit chain to elevate privileges and achieve code execution.

CVE-2024-43093 is the second actively exploited Android Framework flaw after CVE-2024-32896, which was patched by Google back in June and September 2024. While it was originally resolved only for Pixel devices, the company later confirmed that the flaw impacts the broader Android ecosystem.

Found this article interesting? Follow us on Twitter and LinkedIn to read more exclusive content we post.

Was this helpful ?
YesNo

Adnen Hamouda

Software and web developer, network engineer, and tech blogger passionate about exploring the latest technologies and sharing insights with the community.

Related Articles

Leave a Reply

Your email address will not be published. Required fields are marked *

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

The reCAPTCHA verification period has expired. Please reload the page.

Back to top button