Google Releases Android Monthly Patches July 2023

Earlier this week, Google has released its monthly patches for 46 new software vulnerabilities, among them were three that may have been under limited, targeted exploitation, and a critical vulnerability in the Android System component.

The first vulnerability under limited target exploitation tracked as CVE-2023-26083, a memory leak flaw that affected the Arm Mali GPU driver for the Bifrost and Avalon apps and Valhall chips used on Android devices.

This vulnerability was exploited in a previous attack that caused spyware infiltration on Samsung devices in December 2022. This particular bug was added to CISA KEV during April 2023.

The second vulnerability Google issued a patch is CVE-2021-29256, a high-severity issue that affects specific versions of the Bifrost and Midgard Arm Mali GPU kernel drivers. The bug lets an unprivileged user gain unauthorized access to sensitive data and escalate privileges to the root level.

The third limited, targeted, exploited vulnerability tracked as CVE-2023-2136, a critical-severity bug discovered in Skia, Google’s open-source 2D graphics library. It was initially disclosed as a zero-day vulnerability in the Chrome browser and lets a remote attacker who takes over the renderer process implement remote code on Android devices.

Google also patched a critical vulnerability in the Android System component tracked as CVE-2023-21250. This vulnerability could lead to remote code execution with no additional execution privileges needed. Google reports that user interaction is not needed for exploitation