Three Adreno GPU Zero Days In The Wild, Keep An Eye Out For Updates On Your Android

Snappy Patch Releases Needed For Snapdragon

Qualcomm have released three patches for the Adreno GPU found it a vast amount of Android devices; not every Android phone has a Snapdragon GPU but most do so you will need to keep an eye out for updates.  The first two patches address a zero-day discovered back in January and can lead to memory corruption thanks to unauthorized command executions on the GPU.  This is more likely to cause crashes or errors than grant an attacker access to your device, but you can’t rule the latter out.  The third is somewhat more recent, it was reported in March, which is a use-after-free causing memory corruption in Chrome.  This again is more likely to upset your browser than to allow unauthorized access, but we’ve certainly seen use-after-free leveraged in that way.

The patches were released to OEMs and is unfortunately a perfect example of the fractured nature of the Android ecosystem.  While Samsung, OnePlus and Xiaomi have the patch in hand, their users do not.  The patches will be filtered through the OEM’s systems and should be released to users, but for many they will not see anything until the next large update to Android.  Keep an eye out for updates and make sure to install them the moment you can.