A look at an Android ITW DNG exploit
infonews
security
Source: Google Project ZeroDecember 12, 2025
Summary
Between July 2024 and February 2025, malicious DNG files (a raw image format) were discovered that exploited a Samsung vulnerability through the Quram image parsing library. These files were sent via WhatsApp and triggered a spyware infection when users clicked to download the images, which then allowed the malware to run within Samsung's com.samsung.ipservice process, a system service that automatically scans images for AI-powered features.
Solution / Mitigation
The exploited Samsung vulnerability was fixed in April 2025.
Classification
Attack SophisticationAdvanced
Original source: https://projectzero.google/2025/12/android-itw-dng.html
First tracked: February 12, 2026 at 02:28 PM
Classified by LLM (prompt v3) · confidence: 95%