An iOS hacker tries Android
Summary: Google Project Zero researcher Brandon Azad, coming from a background in iOS exploitation, wrote a kernel exploit for the Samsung Galaxy S10 by chaining two bugs in Samsung's Neural Processing Unit driver that Ben Hawkes had reported: a linear heap overflow from a time-of-check-to-time-of-use race on a shared ION buffer, and an out-of-bounds addition at a controlled offset via an unchecked address_vector_index. Samsung patched the issue in November 2020 for devices eligible for security updates, assigning CVE-2020-28343 and SVE-2020-18610.
Why it matters: The bugs were ordinary unsanitized out-of-bounds writes reachable by any normal Android app through /dev/vertex10, and Azad describes the resulting primitives as strong enough that no novel techniques were needed to build a practical exploit.
Read the original at Google Project Zero ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-28343
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026