Attackers exploit 0day vulnerability that gives full control of Android phones

> The bug is a local privilege escalation vulnerability

not as bad as it could have been...

> The use-after-free vulnerability originally appeared in the Linux kernel and was patched in early 2018 in version 4.14,

this happened because Google for some reason uses their own Frankenstein kernel. And this is not the first time it had lead to security issues