Several critical vulnerabilities in Android System and Qualcomm chips were patched
Almost like clockwork, Google releases security patches for Android and its Pixel phones shortly after 10 a.m. Pacific on the first Monday of every month. This month’s update has been hotly anticipated by Pixel owners since it contains the QPR2 Pixel Feature Drop where Google seeds fun new features to its devices. The trouble is, 10 a.m. Pacific came and went hours ago and there’s no update in sight — but there has at least been some movement now.
Google published the March Android Security Bulletin at 10:27 a.m. PDT, outlining all the patches it is submitting to Android Open Source Project in order to fix security vulnerabilities. This brings Android’s newest security patch level up to March 5, 2023, though Google has said it may take up to 48 hours before all the code changes are uploaded to the AOSP repository.
There are two sets of security patches included in this bulletin: March 1, 2023 and March 5, 2023. 18 system vulnerabilities and 8 framework vulnerabilities were fixed in the March 1 update, and a further 5 vulnerabilities will be patched via Google Play System updates. The March 5 update mostly includes fixes for vendor-specific vulnerabilities: 21 for Qualcomm, 4 for Unisoc, and 3 for MediaTek, though there’s also a patch for a CVE in Android’s kernel.
The frustrating message Pixel users are seeing today
Google notes that the worst issue being patched is a critical vulnerability in Android System that could lead to remote code execution. Most vulnerabilities were marked as high severity, but a total of four were deemed critical: CVE-2023-20951 and CVE-2023-20954 in the Android System, as well as CVE-2022-33213 and CVE-2022-33256 in Qualcomm closed-sourced components.
While it’s nice to have the security patches submitted to AOSP, the delayed Pixel update is particularly disappointing with all of the changes Google included in the QPR2 beta releases. Beta 1 had a redesigned quick settings panel with a new animation on the media player and a larger clock, among other goodies. Beta 2 had an option to force-theme all your home screen icons, and Beta 3 brought customizable lock screen shortcuts, so there’s lots to look forward to.
One reliable place to find out about Pixel updates as soon as they’re released is the Google Pixel Community. If you look back through the post history for Pixel updates on that forum, you’ll find that almost every recent monthly update was announced by 10:08 a.m. Pacific at the latest. One exception was the update that came on January 3, which didn’t get announced until 1:19 p.m. PDT on a Tuesday, but this was somewhat expected considering that it was the first update after the holidays.
Here’s hoping we see QPR2 tomorrow, but at this point, Pixel fans are surely getting a little tired of checking for updates by now.
