Loading story…
Amnesty International reported that Serbian authorities used Cellebrite forensic tooling to compromise the Android phone of a student activist, tying the intrusion to a zero-day exploit chain that enabled unauthorized access to the device. The findings expanded Amnesty’s broader documentation of digital surveillance and repression in Serbia, describing targeted mobile compromise as part of a wider campaign against civil society. Google Project Zero separately published technical research on a Qualcomm DSP driver exploit, adding detail on how Android exploitation chains can be built from low-level driver flaws.
Google later shipped Android security updates fixing 62 vulnerabilities, including two actively exploited zero-days, CVE-2024-53150 and CVE-2024-53197, both affecting Android kernel USB-audio ALSA drivers. Security advisories said the bugs could enable out-of-bounds memory reads, exposure of sensitive data, and privilege escalation, and noted reporting that CVE-2024-53197 had been used via Cellebrite tooling in the Serbian case. Defenders were urged to apply the 2025-04-05 Android security update immediately on affected devices.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Google released Android security updates addressing 62 vulnerabilities, including the actively exploited CVE-2024-53150 and CVE-2024-53197 in kernel USB-audio ALSA drivers. CSIRT.SK noted devices lacking the 2025-04-05 security update remained vulnerable and urged immediate patching.
Amnesty International Security Lab published a detailed account of a Cellebrite zero-day exploit used against the phone of a Serbian student activist, adding technical and investigative details about the attack chain.
Amnesty International reported that a Serbian student activist's Samsung Galaxy A32 was infected after Serbian police detained the activist and took the phone to a police station. The compromise chain included exploitation of Android USB kernel vulnerabilities via Cellebrite forensic tooling.
Amnesty International published its report "A Digital Prison," documenting surveillance and repression in Serbia, including forensic findings tied to exploitation of Android vulnerabilities and use of Cellebrite tooling against civil society targets.
Google Project Zero published technical research describing exploitation involving the Qualcomm DSP driver and how the exploit was excavated and analyzed. The post provided technical details that advanced public understanding of the exploit chain.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcesecuritylab.amnesty.org
Open sourceamnesty.org
Open sourcegoogleprojectzero.blogspot.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers and vendors reported **hardware/firmware-level vulnerabilities in Android chip components** that can enable deep device compromise beyond typical app-layer defenses. Ledger’s Donjon research described a flaw involving **MediaTek chip boot-chain behavior and Trustonic’s trusted execution environment (TEE)** that allowed rapid physical compromise: by connecting an affected phone to a laptop over **USB**, attackers could allegedly brute-force the PIN, decrypt storage, and extract sensitive data including messages and **cryptocurrency wallet seed phrases** (e.g., Kraken Wallet, Phantom). The researchers estimated the affected MediaTek chips appear in roughly **one-quarter of Android phones**, disproportionately in lower-cost devices. Separately, Zimperium reported active exploitation of a **Qualcomm graphics zero-day** (**CVE-2026-21385**) in targeted Android attacks, describing a memory-corruption condition that could enable code execution or unauthorized access across “hundreds” of Qualcomm chipsets. A ZDNET article on Android’s *Repair Mode* primarily provides user guidance and anecdotal troubleshooting around a buggy March update/SIM recognition issue; it does not substantively address the chip-level vulnerabilities described in the other reporting and is best treated as tangential consumer advice rather than incident or vulnerability intelligence.
Jun 29, 2026
Google has issued its June 2026 Android security updates to fix **113 vulnerabilities**, including **18 critical** flaws and a zero-day tracked as `CVE-2025-48595` that the company said may be under limited, targeted exploitation. The zero-day affects the **Android Framework** and stems from an integer overflow memory-management issue that can enable code execution and potentially full device compromise. The update also addresses vulnerabilities in third-party components from **Qualcomm, MediaTek, and Unisoc**, and Google said devices running Android 10 or later can receive relevant fixes through Google Play services, with patch levels dated **2026-06-05** or later remediating the documented issues. Google also published its June 2026 **XR Security Bulletin**, disclosing a high-severity flaw, `CVE-2026-0072`, in `InputMethodManagerService`. The bug is caused by a missing permission check in `addInputMethodListener` and can allow **local elevation of privilege** without additional execution privileges or user interaction; Google said it could also permit input text to be read without permission. The XR issue is fixed with security patch level **2026-06-01** or later, while full XR protection requires the broader Android June 2026 patch level as well, underscoring the need for enterprises to accelerate deployment of both platform and device-vendor updates.
Jun 29, 2026
Google issued Android security updates to fix multiple high-severity flaws, including **CVE-2026-0049**, a critical Android Framework vulnerability that can trigger a local denial-of-service with no user interaction and no elevated privileges, and **CVE-2026-0073**, a critical remote code execution bug in the Android System component tied to the Android Debug Bridge Daemon (`adbd`). The `adbd` flaw affects Android 14, 15, 16, and `16-qpr2`, and under proximal or adjacent network conditions could allow shell-level remote code execution on a target device without user action. The April bulletin also addressed **CVE-2025-48651**, a high-severity StrongBox issue affecting hardware-backed key storage implementations from Google, NXP, STMicroelectronics, and Thales, with fixes split between the `2026-04-01` and `2026-04-05` patch levels. Google said the `adbd` issue is remediated by the `2026-05-01` security patch level or later and noted that, because `adbd` is delivered through Project Mainline, mitigations can reach Android 10 and later devices faster through Google Play system updates; organizations were urged to accelerate deployment of the April and May patches across managed mobile fleets.
Jun 29, 2026