Google Warns of Actively Exploited CVE-2024-43093 Vulnerability in Android System

Vulnerability in Android System

Google has warned that a security flaw impacting its Android operating system has come under active exploitation in the wild.

The vulnerability, tracked as CVE-2024-43093, has been described as a privilege escalation flaw in the Android Framework component that could result in unauthorized access to “Android/data,” “Android/obb,” and “Android/sandbox” directories and its sub-directories, according to a code commit message.

There are currently no details about how the vulnerability is being weaponized in real-world attacks, but Google acknowledged in its monthly bulletin that there are indications it “may be under limited, targeted exploitation.”

The tech giant has also flagged CVE-2024-43047, a now-patched security bug in Qualcomm chipsets, as having been actively exploited. A use-after-free vulnerability in the Digital Signal Processor (DSP) Service, successful exploitation could lead to memory corruption.

Cybersecurity

Last month, the chipmaker credited Google Project Zero researchers Seth Jenkins and Conghui Wang for reporting the flaw, and Amnesty International Security Lab for confirming the in-the-wild activity.

The advisory offers no details on the exploit activity targeting the flaw or when it might have started, although it’s possible that it may have been leveraged as part of highly targeted spyware attacks aimed at civil society members.

It’s also currently not known if both the security vulnerabilities were fashioned together as an exploit chain to elevate privileges and achieve code execution.

CVE-2024-43093 is the second actively exploited Android Framework flaw after CVE-2024-32896, which was patched by Google back in June and September 2024. While it was originally resolved only for Pixel devices, the company later confirmed that the flaw impacts the broader Android ecosystem.



Original Source


A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

To keep up to date follow us on the below channels.