Google Fixes Critical Security Vulnerabilities in Android

Google has issued its October security updates for the Android operating system, patching a total of at least 25 vulnerabilities. Seven of these are classified as critical security risks, with one allowing for the remote injection and execution of malicious code.

According to Google's security bulletin, the most severe vulnerability fixed is within a system component and can lead to local privilege escalation without user interaction. Four privilege escalation vulnerabilities in the system are rated critical, and another four are considered high risk. Additionally, a critical denial-of-service vulnerability can be exploited remotely without user interaction.

Google Play system updates include fixes for a denial-of-service vulnerability in the Telephonycore component and two Wi-Fi vulnerabilities. One of the Wi-Fi flaws allows for sandbox breakout and privilege escalation, while the other enables malicious code execution from the network.

The updates affect Android versions 14, 15, 16, 16-QPR2, and 17. Google has not indicated that any of these vulnerabilities are currently being exploited. Samsung has also announced its October security updates, which, combined with Google's patches, address a significant number of various security issues.