Google patches 62 Android flaws, 2 zero-days exploited by Serbian authorities via Cellebrite chain. Update now
Continue reading
Google has rolled out critical patches for 62 security vulnerabilities in its April 2025 Android Security Bulletin, including two zero-day exploits actively weaponized in targeted attacks. The fixes come amid revelations that Serbian law enforcement agencies leveraged a sophisticated exploit chain—developed by Israeli forensics firm Cellebrite—to bypass security on seized Android devices.
The most severe flaw, tracked as CVE-2024-53197, is a high-severity privilege escalation bug in the Linux kernel’s USB-audio driver (ALSA). According to Amnesty International’s Security Lab, Serbian authorities used this vulnerability as part of a multi-layered exploit chain to unlock devices confiscated during investigations.
The chain also included two previously patched zero-days:
Amnesty uncovered the exploits in mid-2024 while analyzing logs from devices unlocked by Serbian police. Google confirmed it had shared fixes for these vulnerabilities with OEM partners in January 2025, ahead of public disclosure.
_“We were aware of these vulnerabilities and the exploitation risk prior to these reports. Fixes were shared with OEMs in a partner advisory on January 18,”_ a Google spokesperson stated.
The April update also addresses CVE-2024-53150, an Android Kernel information disclosure vulnerability allowing local attackers to siphon sensitive data via an out-of-bounds read flaw. Exploitation requires no user interaction, heightening risks for unpatched devices.
Last month’s security update resolved 60 additional vulnerabilities, predominantly high-severity privilege escalation bugs. Google has now issued two patch batches for April:
While Pixel devices receive updates immediately, OEMs like Samsung and Xiaomi face delays due to testing and hardware customization. Experts warn fragmented rollouts leave millions of devices exposed.
This marks the second time in six months Serbian authorities have been tied to Android exploits. In November 2024, Google patched CVE-2024-43047, a zero-day used in NoviSpy spyware attacks targeting activists, journalists, and protesters.
Google’s continued transparency underscores the escalating arms race between tech giants and forensic exploit vendors. As Cellebrite’s tools proliferate globally, timely updates remain the frontline defense for Android’s 3.5 billion users.
A single ClickFix infrastructure is pushing StealC, Amatera, Remus, NetSupport, CastleLoader and a new loader called ResiLoader through fake Google/Cloudflare checks.
