Another serious exploit found in Android's mediaserver component, where Stagefright bugs were found; affects versions 2.3 to 5.1.1; Google's fixed latest build
Wish Wu / TrendLabs Security Intelligence Blog :
Context & Ripple Effects
This is the second act of the Stagefright saga within weeks. In July researchers showed that unpatched phones running Android 2.2 or later could be compromised by a single unopened MMS hitting the native media playback engine (the single-MMS attack). TrendLabs' Wish Wu now reports yet another serious bug in the same mediaserver component — the shared code library that parses media for every app — affecting versions 2.3 through 5.1.1, with Google shipping a fix in its latest build.
The pattern matters because mediaserver is exactly where Google keeps finding flaws: by October, follow-up disclosures had left more than 1 billion Android users exposed to new Stagefright-class bugs, and over the following year Google would patch 115 Stagefright-related flaws. One-off patches are not keeping pace with a systemic weakness.
First-order effects
- Owners of devices on Android 2.3 through 5.1.1 are exposed today unless their carrier or OEM pushes the fixed build — and the July disclosure already proved these bugs can be triggered remotely without any user interaction.
- Google must fold the fix into its monthly security update pipeline while carriers decide when, or whether, to pass builds downstream to already-shipped handsets.
Second-order effects
- Security researchers now treat mediaserver as a repeat hunting ground rather than a one-time find, so each public disclosure raises pressure on Google to re-architect rather than patch — pressure that culminates in Android N splitting MediaServer into isolated pieces with access only to specific subsystems (the MediaServer split).
- Enterprises and carriers face mounting patch-fatigue economics: every new Stagefright-class bug extends the support burden for a fragmented device fleet that largely cannot be updated centrally.
Third-order effects
- If the pattern holds, Android's security model shifts from monolithic trusted components toward sandboxed, least-privilege media processing — a structural redesign forced by attackers rather than product roadmaps.
- The episode hardens the case for decoupling security updates from OS upgrades and carrier release cycles, since version-based exposure windows like 2.3-to-5.1.1 persist only because updates ride the upgrade path.
The trend: Stagefright is turning Android's security story from reactive per-bug patching into architectural isolation of the media stack, with update delivery mechanics becoming the real bottleneck.