U.S. CISA adds Android Framework flaws to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added Android Framework flaws to its Known Exploited Vulnerabilities (KEV) catalog, naming CVE-2025-48572 and CVE-2025-48633. The article notes that Google’s December Android update patched 107 vulnerabilities, including two that were already exploited in the wild, across system, kernel and major vendor components. The two high‑severity flaws are described as under limited, targeted exploitation.

December’s update offers two patch levels (12-01, 12-05) for faster fixes across devices. CISA directs federal agencies to address the identified vulnerabilities by the due date and specifically to fix them by December 23, 2025, according to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities. Experts also recommended that private organisations review the KEV Catalog and address the vulnerabilities in their infrastructure.