> If it's in the DSP it may not need to be an app that runs the exploit. Sounds like any malicious audio or video file could do it. Could be something delivered via a streaming site, email, audio embedded in a webpage, etc. This sounds like it could be a very big deal.

Seems unlikely to me. DSP data vs DSP code - I think it's in the latter that you'll find vulnerabilities.

The fix could also be nothing more than just disable the DSP, a specific functionality or in some other means limit it considerably (for example disabling or heavily restricting its DMA).

So a fix might not be a fix for all, if this bug is in some obscure codec or some extreme edge case that no one uses the fix might be painless, Google might even find a way to soft patch it via GPS but if it’s not then you might have devices either losing key functionality or becoming vulnerable to a pretty severe exploit.

Another question of exploitation is how much hand crafting is required for the payload and does the payload survive common encoders as most social media platforms re-encode or transcode media that is uploaded or shared through their platform even WhatsApp and other messaging apps do it by default (tho those do it to save bandwidth).

If the exploit payload survives common encoders which are used by social media platforms it would be quite a disaster once people understand how it works and can be exploited.

The patch itself also might be bypassable Apple for example fixed an exploit using SEPROM and shortly after that exploit was working again by bypassing the SEPROM boot.

You'd think they'd launch a crash program immediately to do exactly this. "Noone sleeps until this is fixed."

Somehow I doubt that is going to happen, and that's also why I don't use Android.