Android Phones Can Get Hacked Just by Looking at a PNG Image

Using an Android device?

Beware! You have to remain more caution while opening an image file on your smartphone—downloaded anywhere from the Internet or received through messaging or email apps.

Yes, just viewing an innocuous-looking image could hack your Android smartphone—thanks to three newly-discovered critical vulnerabilities that affect millions of devices running recent versions of Google's mobile operating system, ranging from Android 7.0 Nougat to its current Android 9.0 Pie.

The vulnerabilities, identified as CVE-2019-1986, CVE-2019-1987, and CVE-2019-1988, have been patched in Android Open Source Project (AOSP) by Google as part of its February Android Security Updates.

However, since not every handset manufacturer rolls out security patches every month, it's difficult to determine if your Android device will get these security patches anytime sooner.

Although Google engineers have not yet revealed any technical details explaining the vulnerabilities, the updates mention fixing "heap buffer overflow flaw," "errors in SkPngCodec," and bugs in some components that render PNG images.

According to the advisory, one of the three vulnerabilities, which Google considered to be the most severe one, could allow a maliciously crafted Portable Network Graphics (.PNG) image file to execute arbitrary code on the vulnerable Android devices.

As Google says, "the most severe of these issues is a critical security vulnerability in Framework that could allow a remote attacker using a specially crafted PNG file to execute arbitrary code within the context of a privileged process."

A remote attacker can exploit this vulnerability just by tricking users into opening a maliciously crafted PNG image file (which is impossible to spot with the naked eye) on their Android devices sent through a mobile message service or an email app.

Including these three flaws, Google has patched a total of 42 security vulnerabilities in its mobile operating system, 11 of which are rated critical, 30 high and one moderate in severity.

The technology giant stressed that it has no reports of active exploitation or in the wild abuse of any of the vulnerabilities listed in its February security bulletin.

Google said it has notified its Android partners of all vulnerabilities a month before publication, adding that "source code patches for these issues will be released to the Android Open Source Project (AOSP) repository in the next 48 hours."

• Twitter
• Facebook
• Google
• Tumblr
• Pinterest