WARNING: A New Android Zero-Day Vulnerability Is Under Active Attack

Google has disclosed that a now-patched vulnerability affecting
Android devices that use Qualcomm chipsets is being weaponized by
attackers to launch targeted attacks.

Tracked as CVE-2020-11261 (CVSS score 8.4), the flaw
concerns^[1]
an “improper input validation” issue in Qualcomm’s Graphics
component that could be exploited to trigger memory corruption when
an attacker-engineered app requests access to a huge chunk of the
device’s memory.

“There are indications that CVE-2020-11261 may be under limited,
targeted exploitation,” the search giant said^[2]
in an updated January security bulletin on March 18.

CVE-2020-11261 was discovered and reported to Qualcomm by
Google’s Android Security team on July 20, 2020, after which it was
fixed in January 2021.

It’s worth noting that the access vector for the vulnerability
is “local,” meaning that exploitation requires local access to the
device. In other words, to launch a successful attack, the bad
actor must either have physical access to the vulnerable smartphone
or use other means – e.g., a watering hole^[3]
– to deliver malicious code and set off the attack chain.

While specifics about the attacks, the identity of the attacker,
and the targeted victims have not been released, it is not unusual
for Google to withhold sharing such information to prevent other
threat actors from taking advantage of the vulnerability.

If anything, the development once again underscores the need to
promptly install monthly security updates as soon as they are
available to prevent Android devices from being exploited. We’ve
reached out to Google for comment and will update this article if
we hear back.