Google patches 107 Android flaws, including two being actively exploited

Google has patched 107 vulnerabilities in Android in its December 2025 Android Security Bulletin, including two high-severity flaws that are being actively exploited. The fixes cover Android 13, 14, 15, and 16, with patches issued for the framework layer vulnerabilities tracked as CVE-2025-48633 and CVE-2025-48572.

One of these flaws has limited details available, with Google noting it was found in the Framework layer and rated as high severity, while the other involves improper input validation that could allow a local application to execute arbitrary code. Users are advised that attackers would need to trick a user into installing a malicious app to access data and run code on the device.

The article also explains how to verify patch status and update Android devices, emphasising that devices showing a patch level of 2025-12-05 or later are fixed. Keeping Android and Google Play services up to date remains the best defence against known vulnerabilities.