>The critical RCE vulnerability (CVE-2019-2107) in question resides in the Android media framework, which if exploited, could allow a remote attacker to execute arbitrary code on a targeted device.
>The most severe vulnerability in this section [media framework] could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process," Google described the vulnerability in its July Android Security Bulletin.
>However, it should be noted that if such malicious videos are received through an instant messaging app like WhatsApp or Facebook Messenger or uploaded on a service like YouTube or Twitter, the attack won't work. That's because these services usually compress videos and re-encode media files which distorts the embedded-malicious code.
<https://thehackernews.com/2019/07/android-media-framework-hack.html
Hope you don't browse webm threads on your phone, you're about to get wrecked.
