Android Security Alert: Google Patches 120 Flaws, Including Two Zero-Days Under Attack

Google has shipped security updates addressing 120 flaws in Android as part of the September 2025 fixes, including two issues that have been exploited in targeted attacks.

The vulnerabilities include CVE-2025-38352, a privilege escalation flaw in the Linux Kernel component (CVSS score 7.4), and CVE-2025-48543, a privilege escalation flaw in the Android Runtime component; Google said both could lead to local privilege escalation with no additional execution privileges required and that no user interaction is needed to exploit. The company noted there are indications of limited, targeted exploitation, though it did not reveal how the flaws have been weaponised in the wild.

Benoît Sevens of Google's Threat Analysis Group (TAG) has been credited with discovering and reporting the upstream Linux Kernel flaw, suggesting it may have been abused in targeted spyware attacks, according to Google's TAG. Google released two security patch levels, 2025-09-01 and 2025-09-05, to give Android partners flexibility to address similar vulnerabilities across devices more quickly, and encouraged partners to fix all issues in the bulletin and use the latest patch level. Last month, Google released updates to resolve two Qualcomm vulnerabilities that were flagged as actively exploited in the wild.