Why you can trust ZDNET : ZDNET independently tests and researches products to bring you our best recommendations and advice. When you buy through our links, we may earn a commission. Our process

'ZDNET Recommends': What exactly does it mean?

ZDNET's recommendations are based on many hours of testing, research, and comparison shopping. We gather data from the best available sources, including vendor and retailer listings as well as other relevant and independent reviews sites. And we pore over customer reviews to find out what matters to real people who already own and use the products and services we’re assessing.

When you click through from our site to a retailer and buy a product or service, we may earn affiliate commissions. This helps support our work, but does not affect what we cover or how, and it does not affect the price you pay. Neither ZDNET nor the author are compensated for these independent reviews. Indeed, we follow strict guidelines that ensure our editorial content is never influenced by advertisers.

ZDNET's editorial team writes on behalf of you, our reader. Our goal is to deliver the most accurate information and the most knowledgeable advice possible in order to help you make smarter buying decisions on tech gear and a wide array of products and services. Our editors thoroughly review and fact-check every article to ensure that our content meets the highest standards. If we have made an error or published misleading information, we will correct or clarify the article. If you see inaccuracies in our content, please report the mistake via this form.


Patch your Pixel and Samsung phones immediately. Here's why

A pair of severe flaws have been discovered that affect Pixel and Samsung phones that can allow an attacker to compromise your phone and/or your photos.
Written by Jack Wallen, Contributing Writer
The Samsung Galaxy S22 in Bora Purple tucked into a pants pocket.
June Wan/ZDNET

Two very serious vulnerabilities were discovered recently by Google's Project Zero that directly affect Android phones made by Google and Samsung. The vulnerabilities are both tagged as "severe," which means they require immediate patching, otherwise you could be at risk.

It might sound like hyperbole, but this time around it's on the mark. 

Exynos chipset vulnerability

The first vulnerability (and decidedly the worst) affects Exynos modems. There are four vulnerabilities that can cause serious problems with the Exynos hardware such that, even without user interaction, a hacker would only need to know your phone number to create an exploit and compromise your phone remotely. 

Also: The best Android phones 

The known devices that are affected by these vulnerabilities are:

  • Samsung Galaxy S22, M33, M13, M12, A71, A53, A33, A21, A13, A12, and A04 series.
  • Vivo S16, S15, S6, X70, X60, and X30 series.
  • Google Pixel 6, 6 Pro, Pixel 6a, Pixel 7, and 7 Pro.
  • All wearables that employ the Exynos W920 chipset (such as the Galaxy Watch 4 and 5).
  • All vehicles that employ the Exynos Auto T5123 chipset.

All-in-all, a total of 18 zero-day vulnerabilities were discovered in Samsung's Exynos chipsets, with seven of them allowing for remote code execution. 

Also: The best Pixel phones

Google has released the March Pixel update to patch these vulnerabilities. The patch was made available to my Pixel 7 Pro over the weekend, but my wife's Pixel 6 Pro has yet to receive the update. It's crucial that anyone with an affected device checks and applies the update as soon as they are made available to your device. 

How to check for an update on a Pixel phone

1: Open Settings

The first thing to do is open the Settings app on your phone, which you can do from either the gear icon in the Notification Shade or from the App Drawer.

2: Open System Update

Scroll to the bottom of Settings and tap System. From the System page, tap System Update and then tap Check For Update. If there's an update for your phone, apply it immediately.

The Wi-Fi calling feature on a Pixel 7 Pro running Android 13.

If Wi-Fi calling is enabled and you have yet to receive the update, turn off Wi-Fi calling.

Image: Jack Wallen

Checking for updates on Samsung phones

If you use an affected Samsung device, make sure to go to Settings > Software (or System) Updates. If you see the March 1, 2023 Security Patch listed, you're good to go for five of the eighteen vulnerabilities (CVE-2023-26072, CVE-2023-26073, CVE-2023-26074, CVE-2023-26075, CVE-2023-26076). The remaining vulnerabilities have yet to pass the 90-day deadline nor have been assigned CVE-IDs.  Along with the March 1, 2023 update, Samsung updated its advisories to remove the Exynos W920 SoC as an affected chip.

An updated patch shown for a Samsung Galaxy phone.

Samsung phones must have the March 2023 security patch to be safe from the Exynos vulnerability.

Image: Alyson Windsor/ZDNET

What to do if your phone has yet to receive the update?

If your phone has yet to receive the update, you'll want to turn off VoLTE and Wi-FI calling. To do this, go to Settings > Network & Internet > SIMs > Wi-Fi Calling. Make sure to tap the ON/OFF slider for Use Wi-Fi Calling until it's in the off position.

Markup tool for screenshots on Pixel

The next severe vulnerability was found in the Pixel Phone's Markup utility and allows hackers to unredact and uncrop edited screenshots taken on the device. If you take a lot of screenshots (especially those that display sensitive information), this vulnerability should be take seriously. For example, you might share a screenshot that includes bank account information. You might redact the sensitive information before sharing it. With this vulnerability, a hacker could reveal that sensitive information and use it against you.

Also: How to set up a locked folder in Google Photos on Android (and why you should)

Screenshots shared via services that compress and decompress images (such as Twitter) aren't vulnerable. But this is not something you want to take a chance with.

Fortunately, Google patched this flaw in the March Security Update, so, as long as you've applied the patch, you're good to go.

However -- and this is a big "however" -- even with the patch, any screenshot you've taken prior to the update will still be vulnerable. To that end, I would suggest you delete any screenshot (from both phone and cloud) that contains sensitive information (whether you've redacted it or not).

If your Pixel or Samsung phone has yet to receive patches for either/both of these vulnerabilities, I highly recommend you check daily until the update arrives and apply it as soon as it does.

Editorial standards