Report: attackers are exploiting an Android zero-day vulnerability, giving them control of ~18 phone models, including four Pixel models, via a malicious app
and hackers are already using it Ionut Arghire / SecurityWeek : Zero-Day Used in the Wild Impacts Pixel 2, Other Android Phones Ed Targett / Computer Business Review : Samsung S8, S9, Pixel, Huawei Phones Vulnerable to Android Zero Day Alexander Maxham / Android Headlines : Google, Samsung & Other Smartphones Vulnerable To Scary Hack Mihai M. / SamMobile : October security patch fixes serious vulnerability affecting a few Samsung phones Don Reisinger / Tom's Guide : Android Zero-Day Attack Can Hijack Pixel, Samsung Phones: What to Do Ben Lovejoy / 9to5Google : Attackers get full control of Android phones, inc Pixel and Samsung models Ivan Mehta / The Next Web : Google, Xiaomi, and Huawei devices affected by zero-day flaw that unlocks root access The Hacker News : New 0-Day Flaw Affecting Most Android Phones Being Exploited in the Wild Tweets: Pter Szilgyi / @peter_szilagyi : Oh joy! #Android exploit granting full root access that can be delivered remotely via any website through a #Chrome render engine exploit. 😵 https://arstechnica.com/... @arstechnica : Attackers are exploiting a 0-day vuln in Android that can give them full control of at least 18 different phone models, including four different Pixel models, a member of Google's Project Zero research group said on TH night. https://arstechnica.com/... @bobindeepxrp : I'll continue to urge others to NOT conduct crypto business on their phones. Phones are being exploited at an alarming rate and across most platforms and providers. https://arstechnica.com/... Catalin Cimpanu / @campuscodi : Google finds Android zero-day used in the wild -impacts Pixel, Samsung, Huawei, Xiaomi devices -Google linked it to NSO Group -patched in early OS versions, but newer ones vulnerable again -tracked as CVE-2019-2215 -it's an LPE https://www.zdnet.com/... https://twitter.com/...
Context & Ripple Effects
This is a recurrence with a longer tail than most zero-day stories: back in 2016, Ars reported critical Android bugs in older devices being hit by malvertising campaigns and drive-by exploits, and the same structural weakness — a huge installed base that depends on OEMs to ship patches — is what makes today's report matter. What changed is the attacker profile: Google ties CVE-2019-2215 to NSO Group, meaning this is targeted spyware tooling, not opportunistic crime.
The affected set spans vendors — four Pixel models plus Samsung, Huawei, and Xiaomi devices among the ~18 — so remediation runs through Google's October security patch and each OEM's willingness to push it downstream.
First-order effects
- Owners of the ~18 affected models are exposed to full device takeover through a malicious app until their vendor ships the October security patch Google has already issued.
- Samsung, Huawei, and Xiaomi must fold Google's fix into their own update pipelines, putting their patch-delivery speed on public display against Pixel's direct-from-Google path.
Second-order effects
- Attribution to NSO Group shifts the story from bug-fixing to procurement politics: governments and enterprises buying Android fleets now weigh which vendors' devices are the ones spyware vendors target and how fast those vendors patch.
- The episode pressures OEM update commitments — a slow-rolling vendor effectively leaves its customers holding the vulnerable builds while Google's own Pixels are already fixed.
Third-order effects
- If the pattern holds — this 2019 NSO-linked flaw, Project Zero's 2023 Exynos modem zero-days, and Google's 2024 batches including a kernel zero-day flagged as under limited targeted exploitation (50 Pixel fixes and 46 Android fixes) — state-aligned spyware becomes the standing driver of Android's patch cadence, not an anomaly.
- The long tail of unpatched older devices, first visible in the 2016 drive-by wave, keeps growing as exploitation professionalizes, making update delivery rather than vulnerability discovery the industry's real bottleneck.
The trend: Mobile zero-days are shifting from opportunistic drive-by attacks toward targeted spyware exploitation, with Google's monthly patch cycle and OEM delivery speed as the containment mechanism.