Google releases September 2025 Android update, fixes over 80 vulnerabilities, two actively exploited
Take action: This advisory creates a very weird situation - it's urgent because it patches actively exploited flaws, but most users can't rush the patch because their vendors may not have released an updated version of Android for their devices. Be aware that you shouldn't delay the update to your Android when the notification arrives on your phone.
Learn More
Google has released the Android Security Bulletin for September 2025, addressing 84 vulnerabilities. The security update includes patches for two zero-day vulnerabilities actively exploited in targeted attacks. The 84 vulnerabilities are distributed across various Android subsystems including Framework, System, Kernel, and third-party components from manufacturers like ARM, MediaTek, Imagination Technologies, and Qualcomm.
Actively exploited vulnerabilities
- CVE-2025-38352 (CVSS score 7.4) - A local privilege escalation vulnerability in the Linux Kernel time subsystem. This flaw affects the Android Runtime component and has been linked to upstream kernel issues. Exploitation would require local access, likely through a malicious app or shell, but would grant attackers elevated privileges once successful.
- CVE-2025-48543 (CVSS score not assigned) - Elevation of privilege flaw in the Android Runtime (ART) component. Present in Android versions 13 through 16, this vulnerability allows local escalation of privileges without any user interaction, enabling attackers to bypass app sandboxing or gain system-level access on compromised devices. It potentially allows a malicious app to bypass sandbox restrictions and access higher-level system capabilities.
Critical flaw
- CVE-2025-48539 (CVSS score not assigned) - remote code execution vulnerability in the System component. It enables remote (proximal/adjacent) code execution with no additional execution privileges needed and requires no user interaction for exploitation. This vulnerability affects Android versions 15 and 16.
Three other critical vulnerabilities were found in Qualcomm's closed-source components, though Google does not disclose full details:
- CVE-2025-21450 (CVSS score 9.1) - Critical severity flaw in Qualcomm closed-source component
- CVE-2025-21483 (CVSS score not assigned) - Critical severity flaw in Qualcomm closed-source component
- CVE-2025-27034 (CVSS score not assigned) - Critical severity flaw in Qualcomm closed-source component
Given the active exploitation of two zero-day vulnerabilities and the critical nature of the remote code execution flaw, security experts strongly recommend immediate deployment of this update as soon as the phone vendors release the patched version for their respective models.
