In April 2015, Joshua Drake of Zimperium reported a group of integer-overflow and heap-overflow vulnerabilities in Android’s libstagefright library to Google. The component processed multimedia files and MMS attachments, and a specially crafted message could trigger remote code execution and privilege escalation with no user interaction in many cases; an attacker generally needed only the victim’s phone number. The flaws received multiple CVE identifiers, including CVE-2015-1538, CVE-2015-1539, CVE-2015-3824 and CVE-2015-3864, and were estimated to affect about 950 million devices—roughly 95% of Android devices at the time.
Google incorporated a related fix into its internal repositories two days after Drake’s report, but the incident exposed Android’s fragmented security-update structure: carriers and device manufacturers, rather than Google alone, controlled firmware distribution, leaving many older or inexpensive phones unpatched. Drake publicly disclosed the issue on July 27, 2015, presented it at Black Hat on August 5 and DEF CON 23 on August 7, and Zimperium released proof-of-concept code and a detector application. Further Stagefright 2.0 flaws disclosed on October 1, 2015, including CVE-2015-6602, expanded the estimated exposure to about one billion devices. Later Android versions moved software codecs into a sandbox, while 2016 exploits demonstrated that mitigations such as ASLR were not universally sufficient.
