Amnesty International’s Security Lab uncovered a sophisticated Cellebrite zero-day exploit used to unlock the phone of a Serbian student activist, targeting Android USB kernel drivers that could potentially impact over a billion devices. The exploit involved connecting emulated USB devices with specific quirks to corrupt kernel memory and gain root access, revealing significant vulnerabilities in Linux kernel device drivers. The chain combined three upstream kernel bugs: CVE-2024-53104 in the USB webcam (UVC) driver, CVE-2024-53197 in the USB sound card driver and CVE-2024-50302 in the HID touchpad driver. Google’s February 2025 Android Security Bulletin had already fixed the UVC flaw, noting it “may be under limited, targeted exploitation”, while the other two were only patched upstream at the time. This incident highlights ongoing concerns about digital surveillance tools being misused against civil society, with Cellebrite subsequently suspending product use by “relevant customers” in Serbia. GrapheneOS also provided additional analysis on the implications for Android security.
