Google has released the June 2022 security updates for Android devices running OS versions 10, 11, and 12, fixing 41 vulnerabilities, five rated critical.

The security update is separated into two levels, released on June 1 and June 5. The first one contains patches for Android system and framework components and the second one includes updates for kernel and third-party vendor closed source components.

Of the five critical vulnerabilities addressed this month, the one that stands out is CVE-2022-20210, a remote code execution flaw that threat actors can leverage without very demanding prerequisites.

Remote code execution flaws are particularly severe because they can lead to information disclosure, high-level system compromise, and complete device takeover.

Two other important fixes that landed with the first patch level concern CVE-2022-20140 and CVE-2022-20145, both critical-severity escalation of privilege flaws.

These types of vulnerabilities are typically leveraged by malware that has sneaked into a device via a low-privilege pathway like installing a seemingly innocuous application to raise their execution or access authorization as required for malicious intents.

The fourth critical flaw addressed via the “June 1 2022” patch level is CVE-2022-20130, which lies in the Media Codecs component.

The fifth critical flaw fix concerns Unisoc chips only, so it’s only available through the “June 5 2022” patch level.

Unisoc accounts for about 11% of the Android market, mostly found in affordable or rugged devices used in the military, etc.

Applying the available update as soon as they are available for your device is crucial, even if none of the above vulnerabilities are currently marked as actively exploited.

It is worth noting that this month, Samsung beat Google by a day, rolling out the June patch containing all the fixes mentioned above since yesterday.

If your device is no longer supported by the vendor and has stopped receiving security updates, it would be advisable to use a third-party Android distribution that incorporates recent patches and security features for older models.

Original Posts: Android June 2022 updates bring fix for critical RCE vulnerability