Google has released the Android monthly security updates for March 2025 , which fix 44 vulnerabilities . Two of them are actively being used in attacks.
The first vulnerability, which hackers are exploiting, is tracked as CVE-2024-43093 and allows for privilege escalation. It is located in the Framework component and could lead to unauthorized access to the “Android/data”, “Android/obb”, “Android/sandbox” directories and their respective subdirectories.
See also: CISA: Cisco and Windows vulnerabilities in the KEV list
It is worth noting that Google had previously reported that this vulnerability was being used in attacks (security advisory November 2024). It is not clear what prompted the tech giant to issue the warning a second time.
The second vulnerability is tracked as CVE-2024-50302 and also allows privilege escalation. It is located in the HID USB component of the Linux kernel and could lead to the leakage of uninitialized kernel memory to a local attacker via specially crafted HID reports.
Google acknowledged that both CVE-2024-43093 and CVE-2024-50302 have suffered from “limited, targeted exploitation.”.
The CVE-2024-50302 vulnerability is one of three vulnerabilities that were combined into a zero-day exploit to compromise the Android phone of a Serbian activist in December 2024. The exploit involved using CVE-2024-53104, CVE-2024-53197, and CVE-2024-50302 to gain elevated privileges and possibly deploy an Android spyware called NoviSpy.
See also: Cisco patches vulnerabilities in Nexus Switches
All three vulnerabilities are in the Linux kernel and were patched in late 2024. CVE-2024-53104 was patched by Google last month.
The company released two security patch levels, 2025-03-01 and 2025-03-05, to provide flexibility for Android partners to more quickly address some vulnerabilities that are similar across all Android devices.
Android security updates for March 2025
Regularly updating Android devices is essential. These security updates, released by Google on a monthly basis, provide critical fixes for known vulnerabilities and help protect Android users from potential attacks and exploits. It's important to keep your device up to date with the latest updates to ensure the security of your personal information.
In addition to fixing vulnerabilities, these security updates also offer improvements, making your Android experience smoother and more secure. With each update, Google aims to improve the overall performance and security of its operating system, providing a better user experience for everyone.
See also: GitLab vulnerabilities allow bypass of security checks
However, despite these efforts by Google, some Android devices may not receive timely updates for various reasons. It is important for users to check for updates regularly and consider upgrading (replacing) their devices if necessary.
Source: thehackernews.com
