Google patches 90 Android flaws to block remote attacks

Google has issued a significant security update for its Android operating system, addressing more than 90 vulnerabilities across versions 14 to 17. The update is particularly urgent because it closes 26 critical gaps that could allow attackers to execute malicious code on a user’s device without physical access. According to the report from GN technics/mobile (en-US), these flaws represent a serious risk to the stability and privacy of millions of smartphones.

The most concerning issues involve remote code execution, a type of vulnerability that permits unauthorized software to run on a device from a distance. This means a user does not need to tap a link or open a file to be compromised; the attack can happen in the background. While Google has not reported any active exploitation of these specific bugs, the potential for a far-reaching system compromise makes immediate action necessary for all affected users.

Critical flaws span system core

The vulnerabilities are not limited to a single part of the operating system. Google’s advisories indicate that the flaws affect the Android framework and the kernel, which serves as the bridge between software and hardware. Because the kernel is a foundational component, weaknesses here can have widespread effects on how the device operates and secures its data.

Some of the critical issues also allow for privilege escalation. This means an attacker could bypass standard security measures to gain higher-level access rights, effectively turning a minor glitch into a full system takeover. These problems affect multiple Android versions simultaneously, highlighting a systemic weakness rather than an isolated error in one specific update.

Manufacturer delays limit protection

For end-users, the most important step is to install the security update as soon as it becomes available on their device. However, there is a significant trade-off in this process. Google releases the core fixes for Android first, but smartphone manufacturers like Samsung must then adapt and distribute these updates for their specific hardware.

This dependency creates a window of vulnerability. Until a user’s specific phone manufacturer pushes the patch, the device remains exposed to the identified risks. Samsung, for example, has reported additional critical issues in its image decoders, which are part of the broader set of problems being addressed. Users should check their device settings regularly to ensure they have the latest security patches, as delays in distribution are common in the industry.