Google Android Security Updates

Google has released the October 2023 security updates for Android devices running OS versions 11, 12, and 13, fixing 53 vulnerabilities, five of which are rated critical. Two of the critical issues are actively exploited in the wild, which means that attackers are already using them to target Android devices.

Tiered Update Approach

To streamline the update process, Google has segregated the October updates into three levels:

October 1: Targets Android system and framework components.
October 5: Focuses on kernel and third-party vendor closed-source components.
October 6: Addresses the Android system.

Vulnerabilities Under Active Exploitation

CVE-2023-4863: Classified as a critical severity remote code execution flaw. in the WebP code library (libwebp). The consequences of this vulnerability vary, ranging from abrupt system crashes to the more sinister arbitrary code execution. In simpler terms, attackers can potentially take control of the affected system, creating a realm of cyber nightmares.

CVE-2023-4211: A local user, without any privileges, can manipulate GPU memory processing operations to tap into memory that has already been freed. This vulnerability was unearthed and reported to Arm by the vigilant eyes at Google’s Threat Analysis Group (TAG) and Project Zero.