{"uuid": "0eee45f2-b4ed-4617-b4b5-eae92a935f0c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-35674", "type": "seen", "source": "https://t.me/hacking_Attack/117549", "content": "Black Hat Ethical Hacking\nSeptember Android Security Updates: Battling Zero-Day and Critical Bugs\n\nSeptember Android Security Updates: Battling Zero-Day and Critical Bugs\nPost Views: 1 Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Patreon.png Subscribe to Patreon to watch this episode.\nReading Time: 3 Minutes\nIn the latest round of Android security updates for September 2023, Google has addressed a total of 33 vulnerabilities, among which is a high-severity zero-day flaw that is currently under active exploitation.\n\nThis zero-day vulnerability, identified as CVE-2023-35674, resides in the Android Framework and poses a significant security risk. It allows threat actors to escalate privileges without necessitating user interaction or additional execution privileges. Google has issued an advisory, stating that there are indications of limited, targeted exploitation of this vulnerability.\n\nIn response, Google strongly encourages all Android users to update to the latest available version of the operating system. It\u2019s important to note that many security issues in Android become more challenging for attackers to exploit with each new Android platform version.\n\nAside from the zero-day concern, the September Android security updates also tackle three critical security flaws within the Android System component and an additional critical vulnerability within Qualcomm\u2019s closed-source components.\nSee Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses\nThe three critical System vulnerabilities (CVE-2023-35658, CVE-2023-35673, CVE-2023-35681) have the potential to lead to remote code execution (RCE) following successful exploitation, all without requiring extra execution privileges or user interaction. Threat actors could leverage these vulnerabilities in RCE attacks, particularly when platform and service mitigations are disabled for development purposes or when they have successfully bypassed these protections.\n\nThe fourth critical issue (CVE-2023-28581) is characterized by Qualcomm as a WLAN Firmware memory corruption problem. It could enable remote attackers to execute arbitrary code, access sensitive information, or trigger system crashes. What makes this vulnerability particularly concerning is that it can be exploited in low-complexity attacks that do not demand privileges or user interaction.\n\nGoogle has provided two sets of patches for the September 2023 security updates: the 2023-09-01 and 2023-09-05 security patch levels. The latter incorporates all the security fixes from the initial set, along with supplementary patches for third-party closed-source and Kernel components. However, it\u2019s important to note that these additional patches may not be relevant to all Android devices.\nTrending: The Remarkable Journey of Dave Kennedy as a Cyber Security Innovator Trending: Recon Tool: Dirhunt Device manufacturers, apart from Google Pixel devices, will require some time to test and implement these patches for their specific hardware configurations. Therefore, while the initial patch level may be prioritized, this doesn\u2019t necessarily imply an increased risk of exploitation.\n\nThis month\u2019s Android security updates target versions 11, 12, and 13, potentially affecting older, unsupported OS versions as well. Users still operating on Android 10 and older versions should consider upgrading to devices running a supported Android version or explore the possibility of flashing their current device with a third-party Android ROM based on a recent AOSP (Android Open Source Project) version. Security remains paramount in an ever-evolving digital landscape.\nTrending: Microsoft Entra ID Vulnerability Exposes Privilege Escalation Risk Are u a security researcher? O[...]", "creation_timestamp": "2026-09-01T20:00:51.900934Z"}