In December 2022, Google discovered in-the-wild exploit chain targeting Samsung Android devices used by commercial mobile spyware vendor Variston.
It appears that n-day exploits that were fixed in Google products in 2022 (Chrome), were not fixed yet in Samsung (Samsung browser) and because of that exploited by espionage software in early exploitation stages.
Final stage, describes how attacker achieved execution as system_server (CVE-2023-0266, CVE-2023-26083)
https://googleprojectzero.blogspot.com/2023/09/analyzing-modern-in-wild-android-exploit.html