Android Update Patches Exploited Zero-Day, 123 Other Vulnerabilities
Google on Monday announced its latest Android update, which includes patches for 124 vulnerabilities, including a zero-day that has been exploited in targeted attacks.
The exploited vulnerability is CVE-2025-48595, which Google describes as a high-severity privilege escalation issue affecting Android’s Framework component.
“There are indications that CVE-2025-48595 may be under limited, targeted exploitation,” Google said in its advisory.
There does not appear to be any information on the attacks exploiting CVE-2025-48595.
However, commercial spyware vendors have become the dominant force behind most zero-day exploits targeting Android devices, developing and selling sophisticated attack chains primarily to government clients. Google’s own researchers are often the ones who discover these exploits.
Of the remaining vulnerabilities patched in the latest Android versions, 18 have been assigned a ‘critical’ severity rating. They affect the framework, system, and Qualcomm closed-source components, and their exploitation can lead to privilege escalation and denial of service (DoS).
...
Copyright of this story solely belongs to securityweek.com. To see the full text click HERE
