Vulnerability in Android allows access to the device via video

[Brother]

A critical vulnerability has been identified in the Android operating system that could allow attackers to gain access to users' devices. The vulnerability (CVE-2019-2107) affects Android versions 7.0 to 9.0 (Nougat, Oreo and Pie) and allows remote code execution without additional rights. The exploit for the vulnerability was posted on GitHub by researcher Marcin Kozlowski.

As Kozlowski explained, an attacker can compromise a device using a malicious video file, for example, by sending it via email (the Gmail app is capable of downloading videos using the standard Android video player). If the file is opened by a user, an attacker can gain access to the victim's device.

Successful exploitation of the vulnerability is possible on one condition - the user will have to download the malicious video only unchanged. The attack, presumably, will also not be effective when sending a malicious file through services that recode videos, for example, YouTube, WhatsApp, etc.

It is currently unknown exactly how many devices are at risk. There were over 2.5 billion active Android phones in May 2019, according to Google. Of these, almost 58% (about 1.5 billion) are running vulnerable OS versions.

Google has already released an update that fixes the vulnerability.

As a reminder, in early July 2019, it became known that criminals could manipulate media transmitted by users via WhatsApp and Telegram messengers. The issue stems from the Android mobile operating system allowing apps to access files in external storage.