Google was released monthly security updates for Android with fixes for 39 bugs, including a zero-day vulnerability that the company says is currently being used in limited, targeted attacks.
The security gap is described in CVE-2021-1048, and it is a zero-day (use-after-free vulnerability in the kernel) that can be exploited to escalate local privileges. This error is dangerous, as it could allow a malicious user to gain access to or refer to the memory after it is released, leading to a write-what-where condition that executes malicious code to gain control a system.
"There is evidence that CVE-2021-1048 is already in limited use," the company said, without disclosing technical details about the vulnerability or identity of the attackers.
Google Security Update also fixes two critical Remote Code Execution (RCE) vulnerabilities (CVE-2021-0918 and CVE-2021-0930) in the System component that could allow remote attackers to run malicious code as part of a privileged process with sending a specially constructed command.
