I'm curious about this vulnerability. I know that can execute code remotely and needs user interaction, but what type of interaction? Download the image? Copy it? I will appreciate if someone can answer me.
The file can be specifically crafted to trigger the malicious code when the user opens it (views it) on his device (local or via a received link).
The vulnerability associated with the PNG bug can be tracked as CVE-2019-1986, CVE-2019-1987, CVE-2019-1988.
CVE-2019-1986 – Uninitialized errors in SkPngCodec
CVE-2019-1987 – Heap buffer overflow
CVE-2019-1988 – Bug decoding JCS_RGB jpeg files