Internet security firm Checkmarx has discovered (via Forbes) vulnerabilities related to permission bypass issues. After researching this on a Google Pixel 2 XL and Pixel 3, Checkmarx says that the same vulnerabilities are found on the camera apps used on other Android phones including those manufactured by Samsung. With this in mind, the number of smartphone users carrying around this issue on their phones is estimated to be in the hundreds of millions. Erez Yalon, director of security research at Checkmarx said, “Our team found a way of manipulating specific actions and intents making it possible for any application, without specific permissions, to control the Google Camera app. This same technique also applied to Samsung’s Camera app.”

Had this vulnerability been exploited, it could have cost Android device owners some serious money

To show how dangerous this vulnerability is, Checkmarx developed a “proof of concept” app that required no special permissions outside of the aforementioned storage permission. There were two parts to this app; one represented the malicious app installed on an Android phone, and the other part represented the attacker’s command-and-control server. The app that was developed for the PoC was a malicious weather app that connects to the command-and-control server, waiting for instructions from it. This connection persists even if the malicious app is closed.

Google did release a statement that said, “We appreciate Checkmarx bringing this to our attention and working with Google and Android partners to coordinate disclosure. The issue was addressed on impacted Google devices via a Play Store update to the Google Camera Application in July 2019. A patch has also been made available to all partners.”

Had Checkmarx not discovered the vulnerability and brought it to Google’s attention, it could have been exploited by bad actors who would have stolen a ton of money from those sporting an Android phone. The security firm does have a hint for Android device owners, and it is a simple one that doesn’t take much effort or time. “For proper mitigation and as a general best practice, ensure you update all applications on your device,” says the company.