Google Researchers Find 11 Zero-Day Bugs in Samsung Galaxy S6 Edge

Google's Project Zero security team spent a whole week investigating security issues only for Samsung's Galaxy S6 Edge phone, and after their work was done, 11 new, shiny zero-day bugs were brought to light.

Project Zero is a program started by Google, with the aim of improving overall application security by having its own top-of-the-line security experts actively search, find, report, and help fix zero-day bugs in commonly used software.

Their researchers have quite a reputation in the business and were able in the past to find and fix issues with Windows drivers, the Android project, and quite a long list of antivirus engines.

It all started as a game

A few months back, the Project Zero team decided to diversify their daily work routine by focusing all their efforts only on one project at a time, while also splitting into two teams (Europe vs. North America) and see which one discovered the most bugs.

The project they chose to work on was Samsung's latest smartphone, the Galaxy S6 Edge, mainly because it has a large userbase, and also deploys a modified version of Android.

Since Google had already gone over Android's code with a fine-tooth comb, looking for bugs, its Project Zero team was trying to identify new flaws that were introduced by Samsung when it adapted the Android OS to its custom hardware setup.

Before beginning their work, the team also set out to find a specific set of bugs, actively looking for remote exploits that granted them access to contacts, photos, and messages. Additionally, if the developers had found other bugs or a way to gain device persistence, their team would have won extra points.

11 zero-days, most in Samsung's drivers and media processing utilities

While the contest started out for fun, after a week's work, things turned gloomy when the researchers found a total of no less than 11 zero-day vulnerabilities, three of which were trivial to exploit.

"Overall, we found a substantial number of high-severity issues, though there were some effective security measures on the device which slowed us down," says Google's Natalie Silvanovich. "The weak areas seemed to be device drivers and media processing."

The researchers notified Samsung of the issues, which quickly fixed 8 of them during the company's October Maintenance Release, while the other 3 will be solved in November.

Below is a table with all the bugs they've found.