In-the-Wild Series: Android Exploits
Summary: Google Project Zero's fourth in-the-wild report describes a 2020 high-tier attacker pairing a Chrome 0-day with Android privilege-elevation exploits built almost entirely from public code and n-day bugs patched 2 to 5 years earlier, including CVE-2015-1805, CVE-2016-3809, CVE-2015-0570, CVE-2016-0820, CVE-2016-5195 (DirtyCOW) and CVE-2018-9568 (WrongZone). Project Zero estimates copy/paste levels ranging from roughly 90% for the iovy exploit down to 0% for the Qualcomm stack overflow, and notes it could not exhaustively test devices and patch levels, so the attacker may hold Android 0-days that were not captured.
Key Takeaway: An actor with Chrome and Windows 0-days and reliable exploitation tradecraft still found it worth maintaining exploits for Android bugs patched 2 to 5 years earlier, supporting devices long past manufacturer support - so the unpatched handset in your fleet is a working entry point, not a theoretical one.
Read the original at Google Project Zero ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2015-0569CVE-2015-1805CVE-2016-0820
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026