Android Messaging: A Few Bugs Short of a Chain

Summary: Project Zero researcher Natalie Silvanovich reviewed seven Android messaging and mail apps and found three directory traversal vulnerabilities, in Gmail, Outlook and Telegram, all tied to attachment names containing special characters during download. She could not assemble the bugs into a credible attack chain, noting the mail client bugs only worked with non-standard email addresses and none could overwrite an existing file, and all issues were fixed.
Why it matters: The Gmail and Outlook bugs only appeared when those apps were used with an email address not managed by the app's maker, a common setup the researcher suggests is under-tested. The Telegram bug was judged probably exploitable because a configuration file absent by default would be processed if written, and that processing code had a memory corruption flaw.

Read the original at Google Project Zero ↗

Topics: Vulnerabilities & Patching
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026