An anonymous reader quotes a report from TechCrunch: Following preliminary objections over Google's data terms, set out back in January by Germany's antitrust watchdog, the tech giant has agreed to make changes that will give users a better choice over its use of their information, the country's Federal Cartel Office (FCO) said today. The commitments cover situations where Google would like to combine personal data from one Google service with personal data from other Google or non-Google sources or cross-use these data in Google services that are provided separately, per the authority.

Per the FCO decision document (PDF): "The Commitments cover in principle all services operated by Google and directed to end users in Germany with more than one million monthly active users (MAU) in Germany [and Android Automotive whether it meets that threshold or not]." But, as we report below, Google's core platform services designated under the EU's DMA are not covered -- nor is Fitbit, which the document notes is already subject to "far-reaching obligations regarding the cross-service processing of health and wellness data" as a result of EU merger control. [...]

Per the FCO decision document, the implementation date (in principle) for Google's commitments is September 30, 2024 — with an earlier date of March 6, 2024 for commitments covering Google Assistant and Contacts. But the FCO notes that it may provide Google with an extension upon "substantiated request". Once implemented, the commitments will have a five year duration from their start date. The document also notes that if, in the future, a Google service falls out of the DMA designation as a core platform service and meets the FCO usage threshold then these local commitments will be applied to it. The converse will also apply; meaning if the European Commission designates one of the Google services covered by this commitments to the DMA list of core platform services it would no longer fall under this arrangement. Gmail is an interesting example here as the EU recently accepted Google's arguments to exclude the web mail service from the DMA list of core platform services -- but the tech giant is facing future restrictions on how it can use Gmail users' data under the FCO commitments (even if these will only apply in Germany). Commenting in a statement, Andreas Mundt, president of the Bundeskartellamt, said: "Data are key for many business models used by large digital companies. The market power of large digital companies is based on the collection, processing and combination of data. Google's competitors do not have these data and are thus faced with serious competitive disadvantages. In the future users of Google services will have a much better choice as to what happens to their data, how Google can use them and whether their data may be used across services. This not only protects the users' right to determine the use of their data but also curbs Google's data-driven market power. Large digital companies offer a wide range of different digital services. Without the users' free and informed consent the data from Google's services and third-party services can no longer be cross-used in separate services offered by Google or even be combined. We have made sure that Google will provide a separate choice option in the future."

Hyundai and Kia said on Thursday that they will adopt Tesla's electric vehicle charging technology in the United States. Reuters reports: Joining their global peers, including Ford Motor, General Motors and Nissan in adopting Tesla's North American Charging Standard (NACS), Hyundai's and Kia's moves take the Elon Musk-led company's superchargers closer to becoming the industry standard at the expense of the rival Combined Charging System (CCS). Hyundai and Kia's new EVs will come with a NACS port, starting in the fourth quarter of 2024 in the United States, the companies said.

However, in Canada, Hyundai EVs equipped with the NACS port would be available in the first half of 2025, while Kia's EVs with the technology by the end of 2024. The move gives Hyundai and Kia EVs with NACS ports access to more than 12,000 Tesla Superchargers across the United States, Canada, and Mexico, the companies said. The South Korean automakers also said that they would offer adapters to owners of existing and future Hyundai and Kia EVs with the current CCS giving them access to Tesla's Supercharging Network in the first quarter of 2025.

Apple held talks with DuckDuckGo to replace Alphabet's Google as the default search engine for the private mode on Apple's Safari browser, but ultimately rejected the idea. From a report: The details of those talks -- and Apple's discussions about buying Microsoft's Bing search engine in 2018 and 2020 -- were revealed late Wednesday in transcripts unsealed by the judge overseeing the US government's antitrust trial against Google. US District Judge Amit Mehta ruled Wednesday that he would unseal the testimony of DuckDuckGo Chief Executive Officer Gabriel Weinberg and Apple executive John Giannandrea, both of whom testified in the Washington trial in closed sessions. Weinberg testified that DuckDuckGo had about 20 meetings and phone calls with Apple executives, including the head of Safari, in 2018 and 2019 about becoming the default search engine for private browsing mode. In private mode, Safari doesn't track websites that a user visits or keep a history of what a person has accessed.

"We were talking about it, I thought they would launch it," Weinberg said, noting that Apple had integrated several of DuckDuckGo's other privacy technologies into Safari. "Multiple times we've gotten integrations all the way through the finish line. Really, almost everything we've pitched except for search." But Giannandrea, who joined Apple as the head of search in 2018, said that to his knowledge Apple hadn't considered switching to DuckDuckGo. In a February 2019 email to other Apple executives, Giannandrea said it was "probably a bad idea" to switch to DuckDuckGo for private browsing in Safari. "The motivating factor for setting DuckDuckGo as the default for private browsing was an assumption" that it would be more private, Giannandrea testified. Because DuckDuckGo relies on Bing for its search information, it also likely provides Microsoft some user information, he said, which led him to believe that DuckDuckGo's "marketing about privacy is somewhat incongruent with the details."

"Every year the Grace Hopper Celebration, a conference and career fair aimed at non-males, brings women in the tech industry together," writes long-time Slashdot reader piojo. "This year, a large number of men showed up. The women were not pleased." Wired reports: AnitaB.org, the nonprofit that runs the conference, said there was "an increase in participation of self-identifying males" at this year's event. The nonprofit says it believes allyship from men is important and noted it cannot ban men from attending due to federal nondiscrimination protections in the US. Organizers expressed frustration. Past iterations of the conference have "always felt safe and loving and embracing," said Bo Young Lee, president of advisory at AnitaB.org, in a LinkedIn post. "And this year, I must admit, I didn't feel this way."

Cullen White, AnitaB.org's chief impact officer, said in a video posted to X, formerly Twitter, that some registrants had lied about their gender identity when signing up, and men were now taking up space and time with recruiters that should go to women. "All of those are limited resources to which you have no right," White said. [...] During the conference, videos posted to TikTok showed a sea of men waiting in line to enter the conference or speak with recruiters in the expo hall. Men and women are seen running into the expo as a staffer yells for them to slow down. Avni Barman, the founder of female-talent focused media platform Gen She, says she immediately noticed "tons" more men and a more chaotic scene this time compared to previous years. According to Layoffs.fyi, tech companies around the world laid off more than 400,000 workers in 2022 and 2023. "As job cuts bite, all prospective tech workers have become more desperate for opportunities," reports Wired.

Becky Ferreira writes via the New York Times: Last November, a satellite in low-Earth orbit unfurled into an expansive array that extends across nearly 700 square feet, about the size of a studio apartment. The satellite, BlueWalker 3, has since become one of the brightest objects in the sky, outshining some of the most radiant stars in the Milky Way, according to a study published on Monday in Nature -- and it is just the first of dozens of similar satellites that are in development by AST SpaceMobile, a company that aims to keep smartphones connected from orbit. "The issue is not necessarily that one satellite," said Siegfried Eggl, an astrophysicist at the University of Illinois, Urbana-Champaign and an author of the new study, "but that it is a predecessor or prototype of a constellation, so there's going to be a lot of those out there eventually."

Initially launched in September 2022, BlueWalker 3 is the forerunner of AST SpaceMobile's BlueBird satellites, which aim to serve as a network of orbital cell towers with the goal "to democratize access to knowledge and information regardless of where people live and work," a spokesperson for AST SpaceMobile said. Last month, BlueWalker 3 successfully relayed its first 5G connection to a smartphone in a cellular coverage gap on Earth. AST SpaceMobile is one of many companies racing to capture the surging demand for global broadband connectivity. "At the moment, there are 18 constellations that we know are planned all over the world," Dr. Eggl said. "The total number of satellites is a stunning half a million that people are planning to put up there. This is 100 times more than we already have."

AST SpaceMobile made BlueWalker 3's array so large in order to beam strong cellular coverage directly to phones on Earth. The satellite is made of many small antennas that can connect existing smartphones, which is an approach that distinguishes the company from Starlink and other planned constellations that currently rely on ground antennas or dishes. [...] AST SpaceMobile said that it was working with astronomers on techniques to reduce disruptions. It also contrasted the number in its constellation with the tens of thousands planned by other companies. The spokesperson said it could "provide substantial global coverage with around 90 satellites." Though BlueBird satellites would be far fewer in number, they are at least 64 times as big and bright as a Starlink satellite. The SpaceX orbiters are also brightest in the days after their deployment, but they become much fainter once they settle into their target orbits. Astronomers expect that the BlueBird satellites will remain bright in the sky throughout most of their lifetime. As a consequence, one of these satellites could interfere with data captured by astronomical observatories.

Long-time Slashdot reader RockDoctor writes: Regardless of their other potential benefits, modern cars, and modern electric cars in particular, involve complex networks of computer code, hardware, and servo systems cooperating (?) to deliver services to the user, like acceleration, steering and braking. Slashdot nerderati know better than most that such complex networks can never show unexpected, non-designed behavior, due to the infallibility of hardware, program coders and system designers... Yeah. Right. "I'll have some of what he's been smoking!" That's Musk-grade optimism.

On Sunday evening, a middle-aged driver in a "brand new" vehicle found it would not decelerate below 30mph (50kmph). He retained steering control, and avoided crashing until police vehicles "boxed in" his vehicle and helped him exit into a police van (most have sliding side doors) from the moving vehicle. The police then "carried out a controlled halt" on the unmanned vehicle, stopping it from driving away with the van's brakes until a roadside assistance technician arrived 3 hours later and managed to shut it down. "[W]hen the [technician] got to me [...] later, he plugged in the car to do a diagnostic check and there was pages of faults," said the "kidnapped" driver from Glasgow. "He said he had never seen anything like it and decided he was not willing to turn the engine on to see what was wrong."

By inference, the vehicle did not have a mechanical brake ("hand brake": English; "parking brake": American), which should have been able to keep the vehicle halted regardless of the motor's actions (even if a "clutch" did get burned out). From the only time I've been inside an electric car, I can't say if that is normal; it's certainly something I'll look for if I ever rent another. Had the failure happened at 10 a.m. in the morning, not 10 p.m. in the evening, the body count could have been ... substantial.

A dumb question, stemming from my only use of an electric car: do they have a weight sensor under the driver's seat that locks-out the main motor unless there is (say) 30kg in the driver's seat? Most have some such sensors -- they trigger the "seatbelt not fastened" alarm or silence it for empty seats -- but whether they can override the drive system ... ?

An anonymous reader quotes a report from ZDNet: Microsoft's proprietary protocol, Remote Network Driver Interface Specification (RNDIS), started with a good idea. It would enable hardware vendors to add networking support to USB devices without having to build them from scratch. There was only one little problem. RNDIS has no security to speak of. As Greg Kroah-Hartman, the Linux Foundation fellow responsible for stable Linux kernel releases, wrote in November 2022 on the Linux Kernel Mailing List (LKML), "The Microsoft RNDIS protocol is, as designed, insecure and vulnerable on any system that uses it with untrusted hosts or devices. Because the protocol is impossible to make secure, just disable all RNDIS drivers to prevent anyone from using them again."

He added, in another message, "The protocol was never designed to be used with untrusted devices. It was created, and we implemented support for it, when we trusted USB devices that we plugged into our systems, AND we trusted the systems we plugged our USB devices into." That's no longer the case. Kroah-Hartman concluded, "Today, with untrusted hosts and devices, it's time just to retire this protocol. As I mentioned in the patch comments, Android disabled this many years ago in their devices, with no loss of functionality."

[...] But now, sick and tired of having a built-in Windows security exploit in Linux, Kroah-Hartman has decided that enough was enough. He's disabled all the RNDIS protocol drivers in Linux's Git repository. That means that while the RNDIS code is still in the Linux kernel, if you try to build Linux using this new patch, all your RNDIS drivers will be broken and won't build. This is one step short of purging RNDIS from Linux.

An anonymous reader quotes a report from Ars Technica: You can now reply to an email just like it's an instant messaging chat, tacking on a "crying laughing" emoji to an email instead of replying. Google has a whole support article detailing the new feature, which allows you to "express yourself and quickly respond to emails with emojis." Like a messaging app, a row of emoji reaction counts will appear below your email now, and other people on the thread can tap to add to the reaction count. Currently, it's only on the Android Gmail app, but it's presumably coming to other Gmail clients.

Of course, email is from the 1970s and does not natively support emoji reactions. That makes this a Gmail-proprietary feature, which is a problem for federated emails that are expected to work with a million different clients and providers. If you send an emoji reaction and someone on the email chain is not using an official Gmail client, they will get a new, additional email containing your singular reactive emoji. Google is not messing with the email standard, so people not using Gmail will be the most affected.

Another weird quirk is that because emoji reactions are just emails (that Gmail sends to other clients and hides for itself), any emoji reactions you send can't be taken back. There's only Gmail's "Undo send" feature for taking back reactions, which delays sending emails for about 30 seconds, so you can second-guess yourself. After that, you're creating a permanent emoji reaction paper trail. [...] If the idea of emoji reactions to email has you selecting the puke emoji, as far as we can tell, there's no way to just turn this off. The report notes that this new feature won't work on business or school accounts. "Emoji reactions also aren't available for group email lists, messages with more than 20 recipients, emails on which you're BCC'd, encrypted emails, and emails where the sender has a custom reply-to address."

Russia's communications watchdog plans to block VPNs from March 1 next year, a Russian senator for the ruling United Russia party said on Tuesday. From a report: Demand for VPN services soared after Russia restricted access to some Western social media after President Vladimir Putin ordered troops into Ukraine in February 2022. Senator Artem Sheikin said an order from the Roskomnadzor watchdog would come into force on March 1 that would block VPNs. "From March 1, 2024, an order will come into force to block VPN services providing access to sites banned in Russia," Sheikin was quoted as saying by state news agency RIA.

Alongside the Pixel 8 and Android 14, Google today launched the new Pixel Watch 2 -- a $350 second-gen smartwatch featuring a faster processor, overhauled sensor array, and longer battery life. The Verge reports: At a glance, the main difference is that the screen sits flush with the digital crown, where the original had a slight cutout. Another change imperceptible to the naked eye: the body is now made of 100 percent recycled aluminum instead of stainless steel. The result is a slightly lighter watch, but not by much. The Pixel Watch weighed 36 grams, while the Pixel Watch 2 is 31g. That's a bit disappointing, considering the Watch 2's price remains the same as last year. We're looking at the same 41mm case size and OLED display on top. But flip the watch over, and you'll find a completely different sensor array. Instead of a single line of LEDs, there are now multiple LEDs and photodiodes to take measurements from several angles and positions. That then feeds into an algorithm that Fitbit CEO James Park says is 40 percent more accurate for vigorous activities.

This year, Google also added a skin temperature and continuous electrodermal activity (EDA) sensor. Both help enable proactive stress tracking, which Fitbit introduced with its Sense 2. The EDA sensor detects minuscule amounts of sweat, which can help determine bodily stress when combined with metrics like heart rate variability, heart rate, and skin temperature. As with the Sense 2, you're supposed to get a slightly delayed notification when a stressful event has been detected. You're then encouraged to log how that event made you feel. Battery life was a major pain point when the Pixel Watch first launched. Park acknowledges that you couldn't use the always-on display on the first-gen watch if you wanted that 24-hour battery life. This time around, he says that the team has worked hard to make sure the Pixel Watch 2's 306mAh battery can get 24 hours with the always-on display enabled. Users should also be able to get a 50 percent charge in 30 minutes and a full day's worth in 75 minutes. Helping that should be Wear OS 4 -- which Google says ought to extend battery life -- and the new, more power-efficient Qualcomm Snapdragon W5 processor. (Speaking of Wear OS 4, Google says that, at first, it'll be exclusive to Pixel Watch 2.) Other features include the ability to automatically record workouts and do heart rate zone training; a new Safety Check feature that will alert your loved ones of your location after a preset timer expires (e.g. taking an Uber across town or going on a late-night walk); and support for Google services like Gmail, Google Wallet, and Calendar.

You can learn more about the Pixel Watch 2 here.

Los Angeles is housing more people than ever, and building lots more low-income housing, yet it can't keep pace with this ever-rising number of people who end up in cars, tents and shelters. "It's a bucket with a hole in it, so we've got to do something ... to fill that hole," says Dana Vanderford, who helps lead the department's Homelessness Prevention unit. With that goal, the pilot program is using artificial intelligence to predict who's most likely to land on the streets, so the county can step in to offer help before that happens. From a report: The program tracks data from seven county agencies, including emergency room visits, crisis care for mental health, substance abuse disorder diagnosis, arrests and sign-ups for public benefits like food aid. Then, using machine learning, it comes up with a list of people considered most at-risk for losing their homes. Vanderford says these people aren't part of any other prevention programs. "We have clients who have understandable mistrust of systems," she says. They've "experienced generational trauma. Our clients are extremely unlikely to reach out for help." Instead, 16 case managers divide up the lists and reach out to the people on them, sending letters and cold calling.

Android 14 is out today, along with a new Pixel phone. The OS is shipping to supported Pixel devices now, which means the Pixel 4a (5G) and every variant of the Pixel 5, 6, and 7, plus the Fold and Tablet. From a report: The big feature this year is a somewhat customizable home screen. You can pick from several different lock screen clock styles and customize the two bottom app shortcuts. This feels like a response to iOS 16's lock screen widgets (a feature Android used to have back in the 4.2 days) but not nearly as customizable. It's honestly hard to highlight a second Android 14 feature because this is one of the smallest Android releases ever. The first feature Google mentions in its blog post is a new wallpaper picker. On the Pixel 8, Android now has a built-in text-to-image AI wallpaper maker, presumably a feature that lets the Android team adhere to Google's "mandatory AI" company mandate. There's also a new monochrome theme if you're tired of all those "Material You" colors.

Google will soon release a version of its virtual assistant that is powered by the company's Bard artificial intelligence technology, helping users handle more complex tasks. From a report: The new offering, called Assistant with Bard, will be available in a test phase shortly and then roll out to the general public in the coming months, the company said Wednesday. The release will equip the Assistant, which helps users of Android and Google devices complete tasks and find information, with some of the capabilities of Bard, a chatbot that is the company's answer to OpenAI's wildly popular ChatGPT. "Generative AI is creating new opportunities to build a more intuitive, intelligent, personalized digital assistant," Sissie Hsiao, a Google vice president, wrote in a blog post accompanying the news.

Google's newest flagship phone is finally official. The Pixel 8 and Pixel 8 Pro were both unveiled today, with the headline changes being a whopping seven years of updates, flat screens across the board, new CPUs, and a $100 price increase. The Pixel 8 Pro is officially $999, while the Pixel 8 is $699. ArsTechnica: As for specs, the Pro display is a 6.7-inch, 120 Hz, 2992x1344 OLED. Google is branding this display "Super Actua" because it's one of the brightest phone displays on the market at 1600 nits for HDR content and 2400 nits in sunlight mode. That beats the sunlight modes on the S23 Ultra (1750 nits) and iPhone 15 Pro Max (2000 nits) but not the Xiaomi 13T Pro (2600 nits). The storage situation here isn't great. The Pixel 8 Pro has 12GB of RAM and storage tiers of 128GB, 256GB, 512GB, and 1TB. Most other phones in this price range start at 256GB, and the 8 Pro uses slower UFS 3.1 storage instead of the speedy UFS 4.0 a lot of phones ship with now. The 8 Pro battery is 5050 mAh, and there's 30 W wired charging. Wireless charging will hit 23 W on the Pixel charging stand, while Qi chargers will only hit 12 W (it would be great if Qi2 would get its act together). Both phones have IP68 dust and water resistance. On the software update support lifecycle: This year, there is finally something tangible to point to -- 7 years of OS updates. Unlike with previous models, there are no games being played here, as Google says there are "7 years of OS, security, and Feature Drop updates." That's more major OS updates than even iPhone owners are getting, with the iPhone X getting iOS versions 11-16.

Meta is planning to lay off employees on Wednesday in the unit of its metaverse-oriented Reality Labs division focused on creating custom silicon, Reuters reported Tuesday, citing sources familiar with the matter. From the report: Employees were informed of the layoffs in a post on Meta's internal discussion forum Workplace on Tuesday. The post said they would be notified about their status with the company by early Wednesday morning, one of the sources said. Reuters was not able to determine the extent of the cuts to the silicon unit, called Facebook Agile Silicon Team, or FAST, which has roughly 600 employees, according to the other source. The FAST unit is tasked with developing custom chips to power the augmented and virtual reality hardware produced by Meta's Reality Labs division. Meta currently makes a line of mixed reality headsets called Quest and smart glasses designed with Ray-Ban eyeglass maker EssilorLuxottica that can stream video and speak with wearers through a new artificial intelligence virtual assistant.

Google plans to make it harder for spammers to send messages to Gmail users. From a report: The company said it will require emailers who send more than 5,000 messages per day to Gmail users to offer a one-click unsubscribe button in their messages. It will also require them to authenticate their email address, configuring their systems so they prove they own their domain name and aren't spoofing IP addresses. Alphabet-owned Google says it may not deliver messages from senders whose emails are frequently marked as spam and fall under a "clear spam rate threshold" of 0.3% of messages sent, as measured by Google's Postmaster Tools.

Google says it has signed up Yahoo to make the same changes, and they'll come into effect in February 2024. The moves highlight the ongoing fight between big tech companies and spammers who use open systems such as email to send fraudulent messages and annoy users. For years, machine learning techniques have been used to fight spam, but it remains a back-and-forth battle as spammers discover new techniques to get past filters.

An anonymous reader shares a report: Would people pay nearly $14 a month to use Instagram on their phones without ads? How about nearly $17 a month for Instagram plus Facebook -- but on desktop? That is what Meta wants to charge Europeans for monthly subscriptions if they don't agree to let the company use their digital activity to target ads, according to a proposal the social-media giant has made in recent weeks to regulators. The proposal is a gambit by Meta to navigate European Union rules that threaten to restrict its ability to show users personalized ads without first seeking user consent -- jeopardizing its main source of revenue.

Meta officials detailed the plan in meetings in September with its privacy regulators in Ireland and digital-competition regulators in Brussels. The plan has been shared with other EU privacy regulators for their input, too. Meta has told regulators it hopes to roll out the plan -- which it calls SNA, or subscription no ads -- in coming months for European users. It would give users the choice between continuing to access Instagram and Facebook free with personalized ads, or paying for versions of the services without any ads, people familiar with the proposal said.

An anonymous reader quotes a report from CBS News: Your electronic devices may alarm you on Wednesday afternoon — but there's a reason for that. A nationwide test of the federal emergency alert system will be broadcast at approximately 2:20 p.m. EDT to cellphones, televisions and radios across the United States at around the same time. Most Americans with wireless cellular devices will receive an emergency alert message, as will most whose televisions or radios are on when the test occurs.

The Federal Emergency Management Agency will conduct Wednesday's test in coordination with the Federal Communications Commission. Emergency alert messages that make up the test are divided into two groups -- the Emergency Alert System (EAS) for radios and televisions, and the Wireless Emergency Alerts (WEA) for wireless phones -- although both are scheduled to happen at once. Wednesday will mark the seventh nationwide test of the Emergency Alert System. Six previous tests were conducted over the years between November 2011 and August 2021. This will be the third nationwide test of wireless alerts, and the second nationwide test transmitted to all cellphones, FEMA said in a statement. As the wireless alert tests are sent out to phones, the Emergency Alert System tests will be sent out to televisions and radios.

People can elect not to receive certain emergency alert messages to their cellphones from local authorities, or in some instances, simply decide whether to subscribe or not to a specific set of emergency alerts put out by a particular agency. On the other hand, it is not possible to opt out of the upcoming test of the national wireless alert system. All major wireless providers participate in FEMA's wireless alert system. So, most people whose cellphones are turned on and located within range of an active cell tower during the test should receive a message, the agency said (PDF).

Todd Shields and Loren Grush reporting via Bloomberg: Dish Network Corp. was fined $150,000 by US regulators for leaving a retired satellite parked in the wrong place in space, reflecting official concern over the growing amount of debris orbiting Earth and the potential for mishaps. The Federal Communications Commission called the action its first to enforce safeguards against orbital debris. "This is a breakthrough settlement, making very clear the FCC has strong enforcement authority and capability to enforce its vitally important space debris rules," Loyaan A. Egal, the agency's enforcement bureau chief, said in a statement.

Dish's EchoStar-7 satellite, which relayed pay-TV signals, ran short of fuel, and the company retired it at an altitude roughly 76 miles (122 kilometers) above its operational orbit. It was supposed to have been parked 186 miles above its operational orbit, the FCC said in an order (PDF). The company admitted it failed to park EchoStar-7 as authorized. It agreed to implement a compliance plan and pay a $150,000 civil penalty, the FCC said.

An anonymous reader quotes a report from Ars Technica: Arm warned on Monday of active ongoing attacks targeting a vulnerability in device drivers for its Mali line of GPUs, which run on a host of devices, including Google Pixels and other Android handsets, Chromebooks, and hardware running Linux. "A local non-privileged user can make improper GPU memory processing operations to gain access to already freed memory," Arm officials wrote in an advisory. "This issue is fixed in Bifrost, Valhall and Arm 5th Gen GPU Architecture Kernel Driver r43p0. There is evidence that this vulnerability may be under limited, targeted exploitation. Users are recommended to upgrade if they are impacted by this issue."

The advisory continued: "A local non-privileged user can make improper GPU processing operations to access a limited amount outside of buffer bounds or to exploit a software race condition. If the system's memory is carefully prepared by the user, then this in turn could give them access to already freed memory." [...] Getting access to system memory that's no longer in use is a common mechanism for loading malicious code into a location an attacker can then execute. This code often allows them to exploit other vulnerabilities or to install malicious payloads for spying on the phone user. Attackers often gain local access to a mobile device by tricking users into downloading malicious applications from unofficial repositories. The advisory mentions drivers for the affected GPUs being vulnerable but makes no mention of microcode that runs inside the chips themselves.

The most prevalent platform affected by the vulnerability is Google's line of Pixels, which are one of the only Android models to receive security updates on a timely basis. Google patched Pixels in its September update against the vulnerability, which is tracked as CVE-2023-4211. Google has also patched Chromebooks that use the vulnerable GPUs. Any device that shows a patch level of 2023-09-01 or later is immune to attacks that exploit the vulnerability. The device driver on patched devices will show as version r44p1 or r45p0. CVE-2023-4211 is present in a range of Arm GPUs released over the past decade. The Arm chips affected are:

- Midgard GPU Kernel Driver: All versions from r12p0 - r32p0
- Bifrost GPU Kernel Driver: All versions from r0p0 - r42p0
- Valhall GPU Kernel Driver: All versions from r19p0 - r42p0
- Arm 5th Gen GPU Architecture Kernel Driver: All versions from r41p0 - r42p0