Android security update includes patch for actively exploited vulnerability 

Google has addressed a total of 47 security vulnerabilities in its February update for the Android operating system, highlighted by the patching of a critical flaw that has reportedly been under active exploitation. 

The primary focus of the security update is CVE-2024-53104, a high-severity vulnerability affecting the USB Video Class (UVC) driver in the Linux kernel. First disclosed in November 2024, the flaw, which has a CVSS score of 7.8, enables privilege escalation, allowing malicious actors to execute arbitrary code or cause device crashes. The issue, traced back to the introduction of Linux kernel version 2.6.26 in 2008, is rooted in the mishandling of video frame parsing — specifically an out-of-bounds write condition within the “uvc_parse_format()” function.

Google’s advisory indicates that the flaw is being exploited in a limited, targeted manner. The exploitation involves a form of “physical” privilege escalation, suggestive of potential use by forensic tools aimed at extracting data from older devices.

In addition to CVE-2024-53104, Qualcomm has patched a critical vulnerability in its WLAN components, designated as CVE-2024-45569, which carries a CVSS score of 9.8. This flaw relates to a memory corruption issue arising from improper validation of array indices during network management frame processing, posing a significant risk of remote code execution. Qualcomm’s chipsets are widely used in Android devices. 

Google’s Android security update comprises two patch levels — 2025-02-01 and 2025-02-05 — providing Android partners with flexibility in addressing shared vulnerabilities. The latter patch includes additional remedies for kernel and third-party component vulnerabilities, particularly from vendors such as Arm, Imagination Technologies, MediaTek, and Unisoc.

As always, those using Google Pixel will receive prompt access to the patches, while other manufacturers are often slower to roll out security patches, due to the necessity of tailoring security measures to their own bespoke devices. 

You can read the full bulletin here.