Update your Android! Google patches 111 vulnerabilities, 2 are critical

Google has patched 111 vulnerabilities in Android, including two critical flaws, in its September 2025 Android Security Bulletin. The updates cover Android 13, 14, 15, and 16, with vendors notified at least a month before publication, though patches may not be available for all devices immediately.

The article highlights three CVEs linked to the issues: CVE-2025-38352, CVE-2025-48543, and CVE-2025-48539, noting that the latter is a critical vulnerability in the System component that could enable remote code execution with no extra privileges or user interaction required.

CVE-2025-38352 is described as a race condition in the Linux kernel time subsystem that could allow a local attacker to gain elevated permissions, while CVE-2025-48543 is in the Android Runtime and could also lead to local privilege escalation without additional privileges. The piece also discusses the possibility that the remote vulnerability could be exploited from a short distance, potentially via Bluetooth, NFC, or Wi-Fi Direct, underscoring the risk of wormable attacks in crowded settings. Keeping devices up to date is presented as the best defence against these known vulnerabilities.