Google Android has just released its November 2021 security patch, fixing thirty-nine (39) flaws with twenty-nine (29) bugs labeled as “critical”, and one being a critical zero-day vulnerability. The high-risk zero-day, tracked as CVE-2021-1048, is described as a use-after-free (UAF) vulnerability, which stems from incorrect dynamic memory allocation, which does not properly clear the pointer to the memory after freeing up a memory location. The exploitation of this flaw could allow for code substitution which would allow an attacker to escalate their local privileges and perform remote code execution (RCE), giving them full administrative control of the victim system. Although Android has not yet made an official statement about the exploitation of CVE-2021-1048, they did report that, “There are indications that CVE-2021-1048 may be under limited, targeted exploitation,” and researchers believe it could possibly be the work of state-sponsored advanced persistent threat (APT) groups, exploiting the vulnerability for espionage campaigns. The Ankura CTAPT will continue to monitor the outcome of CVE-2021-1048, and an update will be released when more information of how it’s exploited becomes public.