Google Releases Android Patch Update for 3 Actively Exploited Vulnerabilities

The Arm Mali GPU kernel driver (Bifrost, Valhall, and Midgard variants) contains a use-after-free flaw (CWE-416) that allows an unprivileged user to access freed kernel memory. An attacker triggers the bug from a low-privileged process on a device running a vulnerable Mali driver revision, and gains information disclosure and, in many cases, root privilege escalation. Affected ranges are Bifrost r16p0 through r29p0, Valhall r19p0 through r29p0, and Midgard r28p0 through r30p0, which are deployed across a very large base of Android smartphones, tablets, TV boxes, and other embedded devices. The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-07-07), indicating observed exploitation in the wild, though ransomware use is unknown and no public proof-of-concept is available. EPSS assigns a 3.0% probability of exploitation in the next 30 days (87th percentile).

Do: Upgrade the Mali GPU kernel driver: Bifrost and Valhall to r30p0 or later, and Midgard to a release later than r30p0, or apply the equivalent patch delivered by your SoC/OS vendor (e.g., Android security bulletin updates, as referenced in recent Google patch releases). Check the Mali driver revision on affected devices and prioritize patching because the flaw is on CISA's KEV list as actively exploited. As an interim mitigation, avoid running untrusted local code on devices that still run vulnerable Mali driver versions.

In gatt_end_operation of gatt_utils.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

An integer overflow (CWE-190) in Skia, the 2D graphics library used by Chrome's renderer, can be triggered by a crafted HTML page whose content drives Skia processing past the limits of its integer math. A remote attacker who has already compromised the Chrome renderer process — for example through a separate renderer flaw or a malicious page — can leverage the overflow to escape Chrome's renderer sandbox and gain broader code execution on the host. All Google Chrome and Chromium users running versions prior to 112.0.5615.137 are affected, including Chromium packages shipped by Debian and Fedora. The flaw is rated Critical (CVSS 3.1: 9.6) and carries Chromium security severity High, with an EPSS probability of 5.7% (93rd percentile) of exploitation within 30 days. It was added to CISA's Known Exploited Vulnerability catalog on 2023-04-21, and news reports describe it as an actively exploited Chrome zero-day for which Google rushed out the 112.0.5615.137 patch.

Do: Update Google Chrome to 112.0.5615.137 or later on all platforms, and install the corresponding Chromium security updates on Debian and Fedora systems. Because exploitation requires user interaction with a crafted page plus a pre-existing renderer compromise, prompt patching is the primary mitigation; verify via CISA KEV required actions that all managed browsers are updated and confirm Chrome versions in endpoint inventory.

A memory leak (CWE-401) in Arm's Mali GPU kernel drivers affects Midgard (all versions r6p0-r32p0), Bifrost (all versions r0p0-r42p0), Valhall (all versions r19p0-r42p0), and Avalon (r41p0-r42p0), allowing a non-privileged local user to perform valid GPU processing operations that expose sensitive kernel metadata. A local attacker or app on an affected device gains an information-disclosure primitive that reads otherwise protected kernel memory (CVSS 3.1 base score 3.3, confidentiality impact only), potentially aiding further attacks. Exposure applies to any device whose CPU incorporates an affected Mali GPU and runs the corresponding driver, most commonly Android smartphones and tablets built on licensed Mali designs. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2023-04-07), indicating active exploitation, and Arm has issued patched drivers, with fixes also delivered through vendor/Android update channels; ransomware use is unknown.

Do: Apply Arm's patched Mali kernel driver releases (versions beyond the affected ranges) via your SoC/OEM vendor, and on Android devices install the latest Google/OEM security updates, per CISA's required action. Inventory fleets for devices running affected Mali driver generations (Android phones, tablets, and embedded/edge devices) and confirm they receive the fixed driver; note that patching is mandatory for U.S. federal agencies under the KEV program despite the low severity of this local information-disclosure flaw.