Google has released its monthly Android Security Bulletin for March 2025 to address a total of 44 vulnerabilities, including two that it said have come under active exploitation in the wild.
The two high-severity vulnerabilities are listed below –
- CVE-2024-43093 – A privilege escalation flaw in the Framework component that could result in unauthorized access to “Android/data,” “Android/obb,” and “Android/sandbox” directories, and their respective sub-directories.
- CVE-2024-50302 – A privilege escalation flaw in the HID USB component of the Linux kernel that could lead to a leak of uninitialized kernel memory to a local attacker through specially crafted HID reports.
It’s worth noting that CVE-2024-43093 was previously flagged by Google in its security advisory for November 2024 as actively exploited in the wild. It’s not clear what prompted the tech giant to issue the alert a second time.
The Hacker News has reached out to Google for further comment, and we will update the story if we hear back.
CVE-2024-50302, on the other hand, is one of the three vulnerabilities that were chained into a zero-day exploit devised by Cellebrite to break into a Serbian youth activist’s Android phone in December 2024.
The exploit involved the use of CVE-2024-53104, CVE-2024-53197, and CVE-2024-50302 to gain elevated privileges and likely deploy an Android spyware dubbed NoviSpy.
All three vulnerabilities reside in the Linux kernel and were patched late last year. CVE-2024-53104 was addressed by Google in Android last month.
In its advisory, Google acknowledged that both CVE-2024-43093 and CVE-2024-50302 have come under “limited, targeted exploitation.”
The Mountain View-based company has released two security patch levels, 2025-03-01 and 2025-03-05, so as to give flexibility to Android partners to address a portion of vulnerabilities that are similar across all Android devices more quickly.
