It took Google months to patch a serious Android security flaw

The vulnerability affects millions of Android devices with Mediatek's 64-bit chipsets.

Sponsored Links

NatalyaBurova via Getty Images
NatalyaBurova via Getty Images

Google has patched a critical security flaw that affects millions of Android devices with chipsets from MediaTek, XDA Developers revealed today. The vulnerability is a rootkit lodged in the CPU's firmware. It allows a simple script to root Android devices that use nearly any of MediaTek's 64-bit chips, so it has compromised hundreds of budget and mid-range smartphone, tablet and set-top box models, XDA says.

Google noted the patch (CVE-2020-0069) in its March Android security bulletin. While this is the first public disclosure, details about the exploit have been online for months. The vulnerability is still exploitable on dozens of device models, and hackers are actively using it. Worse, in all likelihood, many devices will never get the patch at all.

Hackers that use the exploit can cause damage in a number of ways. For instance, they could install any app and then grant it whatever permission it needs to hack the device. In the wrong hands, root access can empower ransomware and hypothetically make an entire device inoperable.

MediaTek has had patches available to fix this vulnerability since May 2019, but the company can't force OEMs to fix their devices. Google, however, can force many OEMs to do so, through license agreements and program terms, XDA explains. Still according to XDA, Google knew about the vulnerability months before it took action. That's especially disconcerting considering how widespread and dangerous the flaw is.

Turn on browser notifications to receive breaking news alerts from Engadget
You can disable notifications at any time in your settings menu.
Not now

Engadget has reached out to Google for comment.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission. All prices are correct at the time of publishing.
View All Comments
It took Google months to patch a serious Android security flaw