Google has launched the June 2026 Android safety patches to deal with 124 vulnerabilities, together with one zero-day flaw exploited in focused assaults.
Native attackers can exploit the actively abused high-severity Android Framework vulnerability (tracked as CVE-2025-48595) to achieve code execution and escalate privileges on gadgets working Android 14 or later.
“There are indications that CVE-2025-48595 could also be underneath restricted, focused exploitation,” the corporate stated on Monday in its March 2025 Android Safety Bulletin.
“Exploitation for plenty of problems on Android is made tougher through improvements in more moderen variations of the Android platform. We inspire all customers to replace to the newest model of Android the place imaginable.”
Whilst Google has but to percentage technical information about the flaw or supply extra details about the continued assaults concentrated on it, an identical flaws were exploited up to now through business spyware and adware and through geographical region operations concentrated on high-profile or high-interest folks.
With this month’s Android safety updates, Google has mounted 18 vital vulnerabilities throughout Device, Framework, and Qualcomm closed-source elements that attackers can abuse to cause denial-of-service prerequisites and lift privileges on unpatched Android gadgets.
“Essentially the most critical of those problems is a vital safety vulnerability within the Framework part that would result in faraway escalation of privilege with out a further execution privileges wanted. Person interplay isn’t wanted for exploitation,” Google added.
On Monday, Google issued two units of patches: the 2026-06-01 and 2026-06-05 safety patch ranges, with the latter bundling all fixes from the primary batch, in conjunction with patches for closed-source third-party and kernel subcomponents that would possibly not follow to all Android gadgets.
Whilst Google Pixel gadgets will obtain those safety updates in an instant, different distributors will incessantly take longer to check and tweak them for particular {hardware} configurations.
A Google spokesperson was once no longer in an instant to be had for remark when BleepingComputer reached out for extra main points in regards to the CVE-2025-48595 assaults and their objectives.
Google launched patches for 2 different high-severity zero-days (CVE-2025-48633 and CVE-2025-48572) in December, and for any other zero-day flaw in a Qualcomm show part (CVE-2026-21385) in March, all of which have been tagged as “underneath restricted, focused exploitation.”
Closing month, Google additionally overhauled its Android and Chrome vulnerability rewards techniques, providing bounties of as much as $1.5 million for some Android exploits whilst scaling again payouts for flaws which might be more uncomplicated to seek out the usage of synthetic intelligence (AI).
Computerized pentesting gear ship actual price, however they had been constructed to respond to one query: can an attacker transfer during the community? They weren’t constructed to check whether or not your controls block threats, your detection regulations fireplace, or your cloud configs hang.
This information covers the 6 surfaces you if truth be told want to validate.
Obtain Now
