Samsung Galaxy phones found a serious security vulnerability that took 6 years to fix

       According to media reports, Samsung released monthly security updates and smartphones sold since the end of 2014 have a "perfect 10" critical security vulnerability that can enable arbitrary remote code once exploited.

　　According to reports, Samsung added support for the Qmage image format (.qmg) to all its mobile phones at the end of 2014, and Samsung's customized Android system has vulnerabilities in handling Qmage.

　　Mateusz Jurczyk, a security researcher at Google's Project Zero, discovered a way to exploit Skia (Android's graphics library) to process Qmage images sent to the device.

　　Jurczyk said the Qmage bug can be exploited with zero clicks, without user action, by repeatedly sending MMS messages to a Samsung device, with each message attempting to guess where the Skia library is located in the Android phone's memory, which is necessary to bypass Android's ASLR (Address Space Layout Randomization) protection.

　　The attacker typically takes around 100 minutes to send 50 to 300 MMS messages to probe and bypass ASLR. Once the Skia library is located in memory, the last MMS message delivers the actual Qmage payload, which then executes the attacker's code on the device.

　　While this attack may seem intensive, it can also be modified to execute without alerting the user. Samsung fixed this in a May security update.