Quote:Google updated its May 3 Android security bulletin on Wednesday to say that there are “indications” that four of the 50 vulnerabilities “may be under limited, targeted exploitation.” That was mostly confirmed by Maddie Stone, a member of Google’s Project Zero exploit research group, who clarified on Twitter that the “4 vulns were exploited in-the-wild” as zero-days.

Quote:Android has updated the May security with notes that 4 vulns were exploited in-the-wild. Qualcomm GPU:
CVE-2021-1905, CVE-2021-1906 ARM Mali GPU: CVE-2021-28663, CVE-2021-28664
https://source.android.com/security/bulletin/2021-05-01

 Google Android exploits are a rarity. These four bugs make up a full two-thirds of the six total bugs to be exploited in the wild since 2014, according to Google’s tracking spreadsheet. Project Zero’s Stone went on to celebrate that fact, pointing out that “For 2021, we’ve surpassed the number of 0-days detected in-the-wild in all of 2020. That’s great!”
 
According to security firm Zimperium, Google disclosed only one zero-day vulnerability in Android in 2020.