Google’s bug bounty team detects 18 zero-day vulnerabilities in Samsung’s Exynos chipset

18 zero-day vulnerabilities compromising device security were detected in Samsung’s Exynos chipsets, with seven of the most severe of these allowing for internet-to-baseband remote code execution. Attackers can remotely compromise a phone at the baseband level with no user interaction, and require the victim’s phone number to compromise affected devices silently and remotely, Google’s Project Zero team said in a blog post. Other vulnerabilities detected in Samsung’s Exynos chipsets were found to require either a malicious mobile network operator or an attacker with local access to the device. Google’s Project Zero team has also delayed the disclosure of the four vulnerabilities that allow for Internet-to-baseband remote code execution.