Security Experts:

Connect with us

Hi, what are you looking for?


Mobile & Wireless

Google Patches Over a Dozen High-Severity Privilege Escalation Flaws in Android

Google this week published its Android security bulletin for February 2021, which includes information on more than 40 vulnerabilities, most of which could lead to elevation of privilege.

Google this week published its Android security bulletin for February 2021, which includes information on more than 40 vulnerabilities, most of which could lead to elevation of privilege.

The first part of the monthly update, which arrives on devices as the 2021-02-01 security patch level, includes fixes for a total of 20 vulnerabilities, 15 of which lead to elevation of privilege.

The most important of these vulnerabilities is a critical flaw in the Media Framework component that could allow an attacker to execute arbitrary code on a vulnerable device. The attacker needs to supply a specially crafted file to trigger the bug.

Tracked as CVE-2021-0325, the issue is considered critical on Android 8.1 and 9 platform releases, but has only a high severity rating on Android 10 and 11, Google’s advisory explains.

Two other flaws patched in Media Framework this month, namely CVE-2021-0332 and CVE-2021-0335, were rated high severity. The bugs could lead to elevation of privilege and information disclosure, respectively.

Google also patched an information disclosure flaw in Android runtime, along with nine elevation of privilege and one denial of service issue in Framework, all of which were rated high severity.

The System component received patches for six vulnerabilities, namely one critical remote code execution bug and five high-severity elevation of privilege issues. One vulnerability was patched in the media codecs component.

The second part of this month’s security update, which is delivered to devices as the 2021-02-05 security patch level, includes patches for 23 vulnerabilities in Kernel components (one high-severity bug), Qualcomm components (one critical and five high-severity flaws), and Qualcomm closed-source components (two critical and fourteen high-severity issues).

A single patch was included in this month’s Pixel update bulletin, for a moderate-severity vulnerability (CVE-2020-11203) in Qualcomm closed-source components.

Pixel devices, Google explains, will receive patches for all the security vulnerabilities in the February 2021 Android security bulletin, and for the bug described in the Pixel update bulletin.

There are no reports that the vulnerabilities addressed in this month’s Android security bulletin are being exploited in the wild, the Multi-State Information Sharing and Analysis Center (MS-ISAC) says.

Related: Google Releases January 2021 Security Updates for Android

Related: December 2020 Android Updates Patch 46 Vulnerabilities

Related: Google Patches 30 Vulnerabilities With November 2020 Android Updates

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.