A critical vulnerability in Chrome for Android has been reported that makes it possible for attackers to take over a device. The vulnerability was demonstrated at the MobilePwn2Own, PacSec conference in Tokyo. The researcher believes that the vulnerability affects all versions of Android capable of running the latest version of Chrome.
An attacker is then able to install an arbitrary application and gain the full privileges of the device. He noted that the attack was "one shot exploit," essentially meaning that just one vulnerability was enough to perform the attack. The exploit worked on many other devices as well, said Dragos Ruiu, the organiser of PacSec.
"The impressive thing about Guang's exploit is that it was one shot; most people these days have to exploit several vulnerabilities to get privileged access and load software without interaction," Ruiu told Vulture South.
Working details of the vulnerability haven't been disclosed, and Ruiu said that Google had been made aware of the vulnerability.
At the same event, two security researchers managed to trick the Samsung Galaxy S6, Galaxy S6 Edge, and the Galaxy Note 4 to connect to a compromised base station and had the calls and messages go through it. As a result of which, a victim's calls and messages could be intercepted.