Google Patches 107 Android Flaws, Including Two Framework Bugs Exploited in the Wild

Google has released its December 2025 Android security updates, addressing 107 flaws across Framework, System, Kernel and third‑party components from Arm, Imagination Technologies, Mediatek, Qualcomm and Unison, with two Framework bugs among those exploited in the wild.

The two high‑severity CVEs cited as being used are CVE‑2025‑48633, an information disclosure vulnerability in Framework, and CVE‑2025‑48572, an elevation of privilege vulnerability in Framework, though Google says details about the attacks and scale are not disclosed. In addition, the advisory notes a separate critical Framework flaw, CVE‑2025‑48631, which could allow remote DoS with no extra privileges required.

To help device makers catch up, the bulletin includes two patch levels: 2025‑12‑01 and 2025‑12‑05, enabling faster remediation of vulnerabilities common across Android devices. There are indications of limited, targeted exploitation, and users are urged to update to the latest patch level as soon as feasible, according to Android Security Bulletin.