Two Exploited Vulnerabilities Patched in Android

Two privilege escalation flaws in Android Runtime (CVE-2025-48543) and the Linux kernel (CVE-2025-38352) were exploited in targeted attacks, according to SecurityWeek. Google this week rolled out fixes as part of the September 2025 patch set, which patched 111 unique CVEs including exploited zero-days. There are indications that the following may be under limited, targeted exploitation: CVE-2025-38352 and CVE-2025-48543, according to Google’s advisory.

The Linux kernel bug related to handling of POSIX CPU timers had fixes announced in July, and the Android Runtime zero-day has been resolved as part of the 2025-09-01 security patch level. Devices updated to the 2025-09-05 patch level will receive fixes for the Linux kernel bug and 51 other issues affecting various components. Wear OS, Pixel Watch, and Automotive OS updates also include related fixes, with users advised to update to the 2025-09-05 security patch level when available.