Android’s December 2025 Updates Patch Two Zero-Days

According to SecurityWeek, Google on Monday released new Android security updates and warned that two of the resolved vulnerabilities have been exploited in limited, targeted attacks. The exploited zero-days are tracked as CVE-2025-48633 and CVE-2025-48572, affecting the Framework component and potentially enabling information disclosure or elevation of privilege.

The December 2025 Security Bulletin notes there are indications of limited, targeted exploitation for these flaws, and Google states they impact Android versions 13, 14, 15, and 16. The issues were addressed in the first part of Android’s December 2025 update, arriving at the 2025-12-01 security patch level and covering 51 vulnerabilities in the Framework and System components; a second part at 2025-12-05 contains fixes for all remaining bugs, bringing the total to 107 addressed vulnerabilities.

Patches also apply to the kernel and various chipset components from Arm, Imagination Technologies, MediaTek, Unisoc, and Qualcomm, while there are no fixes in Google Play system updates or in Android Automotive OS and Wear OS bulletins this month. Devices with patch level 2025-12-05 or later receive fixes for all vulnerabilities resolved in these updates and prior Android patches.