4 ms·

> When clicked, the links redirected visitors to pages hosting exploits for either Android or iOS then redirected them to legitimate websites such as the page t

> When clicked, the links redirected visitors to pages hosting exploits for either Android or iOS then redirected them to legitimate websites such as the page to track shipments for Italian-based shipment and logistics company BRT or a popular Malaysian news website. So at least this is not a 0-click exploit I'm an Android Pixel (5a) user, how does this affect me... > The Android exploit chain targeted users on phones with an ARM GPU according to Wikipedia, my Pixel 5a has an Adreno 620 GPU made by Qualcomm so looks like I'm safe there. Curious to know which phones use the ARM GPU, not sure if this is a complete list but I found this[0] on an ARM website. Looks like Pixel 6 and 7 are affected since they use the Tensor chip which are ARM64 based. > running Chrome versions prior to 106. Current Chrome for Android version on my phone is 111.0.5563.116. The earliest version of Chrome for Android version 106 I can find is late Sept 2022[1], so not super long ago but it was at least fixed back in Sept. > Note, Pixel devices with the 2023-01-05 security update are protected against both exploit chains in this blog. My last security update was 2023-03-05 (and I mentioned my Chrome version above) so I'm protected > Chrome users updated to at least version 108.0.5359 are also protected. So which is it? affects users of Chrome prior to 106 yet you need to be on Chrome 108 to be protected? This is a bit confusing. Looks like Chrome for Android v108.0.5359.x was released late November 2022[2]. Just needed to do that for peace of mind. I understand that Google wouldn't be posting this if they hadn't at released a fix for this and handled their Pixel phones. I really wish there was some kind of database where I can look up a phone model and see a list of exploits and whether they have been patched or not, at least when they are hardware and/or OS related. 0. https://developer.arm.com/Tools%20and%20Software/Arm%20Mobile%20Studio#Supported-Devices https://developer.arm.com/Tools%20and%20Software/Arm%20Mobil... 1. https://chromereleases.googleblog.com/2022/09/chrome-for-android-update_01538182103.html https://chromereleases.googleblog.com/2022/09/chrome-for-and... 2. https://chromereleases.googleblog.com/2022/11/chrome-for-android-update_29.html https://chromereleases.googleblog.com/2022/11/chrome-for-and...

wccrawford 4y ago
It could be that Chrome 106 on OS 2023-01-05 are protected, or just Chrome 108 on any OS is protected. Or it could be sloppy reporting.
- 3np 4y ago
  Without reading more than the comment chain, the fix could be backported to a more recent 106.x but existing 106 releases are still vulnerable (sloppy reporting).
tialaramex 4y ago
> Just needed to do that for peace of mind. I understand that Google wouldn't be posting this if they hadn't at released a fix for this and handled their Pixel phones. Google is a large organisation. Project Zero at least is quite content to give other Google projects the usual amount of time and then publicise an unfixed bug. No favours.
- hrrtyyuuhggg 4y ago
  this is not from pzero
  - tialaramex 4y ago
    That's correct, it isn't, but the parent comment suggested Google would always have fixed stuff before it's announced by Google and that assumes a more unified organisation, a single controlling mind or else a conspiracy and that's not how it works.
neurostimulant 4y ago
> Curious to know which phones use the ARM GPU, not sure if this is a complete list but I found this[0] on an ARM website. Looks like Pixel 6 and 7 are affected since they use the Tensor chip which are ARM64 based. Probably just sloppy writing. In this write up, the bug doesn't seem to be specific to a particular GPU model. It's basically a buffer overflow in Chrome's OpenGL ES code: https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2022/CVE-2022-4135.html https://googleprojectzero.github.io/0days-in-the-wild//0day-...

wccrawford 4y ago

It could be that Chrome 106 on OS 2023-01-05 are protected, or just Chrome 108 on any OS is protected. Or it could be sloppy reporting.

3np 4y ago
Without reading more than the comment chain, the fix could be backported to a more recent 106.x but existing 106 releases are still vulnerable (sloppy reporting).

tialaramex 4y ago

> Just needed to do that for peace of mind. I understand that Google wouldn't be posting this if they hadn't at released a fix for this and handled their Pixel phones. Google is a large organisation. Project Zero at least is quite content to give other Google projects the usual amount of time and then publicise an unfixed bug. No favours.

hrrtyyuuhggg 4y ago
this is not from pzero
- tialaramex 4y ago
  That's correct, it isn't, but the parent comment suggested Google would always have fixed stuff before it's announced by Google and that assumes a more unified organisation, a single controlling mind or else a conspiracy and that's not how it works.

neurostimulant 4y ago

> Curious to know which phones use the ARM GPU, not sure if this is a complete list but I found this[0] on an ARM website. Looks like Pixel 6 and 7 are affected since they use the Tensor chip which are ARM64 based. Probably just sloppy writing. In this write up, the bug doesn't seem to be specific to a particular GPU model. It's basically a buffer overflow in Chrome's OpenGL ES code: https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2022/CVE-2022-4135.html https://googleprojectzero.github.io/0days-in-the-wild//0day-...