Android Emergency: Critical DoS Flaw and 2 Exploited Zero-Days in Framework Require Immediate Patch

Google has released the Android Security Bulletin for December 2025, detailing vulnerabilities and active exploitation in the wild, including a critical flaw in the Android Framework that could allow remote attackers to disable devices. Patches are being rolled out in two phases: the 2025-12-01 level covers core Android components (Framework, System), while the 2025-12-05 level addresses kernel and vendor-specific issues.

The bulletin notes that at least two vulnerabilities listed are likely being weaponised by attackers, with indications that some may be under limited, targeted exploitation; CVE-2025-48633 is an Information Disclosure vulnerability in the Framework, and CVE-2025-48572 is an Elevation of Privilege flaw in the Framework affecting Android 13, 14, 15 and 16.

The most severe issue, CVE-2025-48631, is a remote Denial of Service flaw in the Framework that could lead to remote DoS with no additional execution privileges needed. Additional critical flaws exist in the PKVM and IOMMU subsystems, and hardware fixes span Qualcomm, MediaTek, Unisoc, and graphics drivers from Arm and Imagination, with users urged to reach the 2025-12-05 patch level.