Android vulnerabilities allow a remote attacker to control devices through a crafted PNG file

If you feel that opening a picture should not have any security issues, then this post may let you change the previous views. The attacker only needs to create a picture in PNG format containing a specific code to launch the attack. This issue is “a critical security vulnerability in Framework that could allow a remote attacker using a specially crafted PNG file to execute arbitrary code within the context of a privileged process. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed.”

Vulnerabilities that can be exploited mainly affect Android 7.0~9.0. At present, Google has made security updates released to the Android Open Source Project.  The company did not disclose the details of the vulnerability, but it is said that a vulnerability exists in the Android framework that allows an attacker to execute code on a privileged process. The direct result is that the attacker can get the highest authority of the system to directly control the entire device.

Although Google has published an overview of the vulnerability and made a security update, Google has not disclosed any technical details or other methods that may mitigate the vulnerability. Considering that most Android devices are updated slowly or even not updated, once the hacker finds the details of the vulnerability through patch reverse engineering, the consequences are unimaginable. Unfortunately, there is no potential mitigation method that means that users may be attacked by this flaw.

Of course, if the user who can update is better to update as early as possible, it is very important to choose the manufacturer that is updated frequently when purchasing Android devices.