Researchers find bugs in Google and Samsung camera apps from before July 2019 that could record video, take pictures, and extract GPS data without permission
A new vulnerability has been found in the Camera apps for millions, if not hundreds of millions, of Android devices that could allow …
Context & Ripple Effects
This disclosure lands two weeks after reports that attackers were actively exploiting an Android zero-day via a malicious app across roughly 18 phone models including four Pixel devices (an actively exploited Android zero-day), extending a pattern of camera-and-apps attack surface on Android rather than starting one.
It also revives an older finding from Google's own researchers, whose Galaxy S6 Edge audit showed Samsung's OEM customizations had introduced eleven vulnerabilities (eleven vulnerabilities introduced by Samsung's own code) — evidence that vendor-added software, not just AOSP core, is where Android device risk concentrates. The camera bugs matter because the affected builds shipped on hundreds of millions of devices, and many will never receive a fix.
First-order effects
- Owners of devices running pre-July 2019 Google and Samsung camera app builds are exposed right now: any installed app exploiting the flaw can record video, take pictures, and read GPS data without triggering a permission prompt.
- Google and Samsung are pushed into emergency patching across an enormous installed base, with the hardest-hit segment being older and budget devices that sit outside fast update channels.
Second-order effects
- The disclosure sharpens buyer and researcher scrutiny of preinstalled vendor software — the same class of risk behind researchers' later finding that preinstalled Android apps could reach logs holding sensitive contact-tracing data (preinstalled apps exposing contact-tracing logs) — pressuring both OEMs and Google over who audits bundled code.
- Enterprises and carriers weighing Samsung-heavy fleets gain fresh ammunition to demand faster security-update commitments and tighter controls on what preinstalled apps may access.
Third-order effects
- If the pattern holds — OEM-added code repeatedly producing vulnerabilities beyond stock Android — the structural pressure points toward Google tightening certification requirements for preinstalled apps and toward longer guaranteed update lifecycles as a purchasing criterion, reshaping how Android security responsibility is divided between Google and device makers.
The trend: Android security risk is migrating from the OS core to the preinstalled, vendor-added app layer, forcing Google and OEMs to treat bundled software as a first-class attack surface.