Android and device manufacturers: If you have a Google Pixel smartphone, your phone is safe from a security flaw that could let a PNG file completely destroy your system. Now, if your device is any other device running Android, then your phone is vulnerable.
This is of course a problem for Android.
Google recently released a security update for Pixel devices, which closes a loophole that allowed malicious PNG files to “run arbitrary code with administrator privileges.”
In other words, malicious code can run with very high privileges while all you do is open a PNG file.
This means that any PNG that comes to your device (via an email, a messaging app, or even via MMS) could potentially compromise the system and steal sensitive data on any non-Pixel phone.
Phones from Samsung, LG, OnePlus, and many other manufacturers are still at risk from the vulnerability.
The problem is not new. It's something we've known about for a long time, and it continues to worry all users of Google software. As long as new vulnerabilities appear, delayed security updates will always be a very serious problem.
Android fragmentation has long been a big problem, especially with operating system updates. Of course, we're not talking about updates that add new features, but rather code updates that protect your personal data. Regardless of whether they're small or not, these updates shouldn't be ignored by any manufacturer.
Security updates aren't huge like feature updates. They're released monthly by Google, so they're much smaller and easier to install on your system — even for third-party manufacturers. So while we hear excuses for not installing them, it seems like it's purely a matter of manufacturer priorities.
New vulnerabilities will constantly emerge, and no one wants to risk their data. However, no one demands that device manufacturers immediately release updates as soon as they are released by Google.
The PNG vulnerability is just one example. Security holes like this are discovered every month, and most manufacturers release updates months later. This leaves your data exposed for much longer.
There doesn't seem to be an easy answer here for how to fix things. Maybe because there isn't one.
Until manufacturers start taking your security and data more seriously, there's only one answer: buy a different device. Apple and Google have proven that they care about user data, so the iPhone and Pixel seem to be great choices for those who want and demand more security.
It may sound cliché, but it's time to vote with your wallet. Don't buy devices from manufacturers who don't care about your data. It's the only way they'll understand the seriousness of the issue.
