Google fixes actively exploited Android flaws in September update

Google has released the September 2025 Android security update, addressing a total of 84 vulnerabilities, including two that were actively exploited in zero-day attacks. These two flaws are CVE-2025-38352, an elevation of privilege in the Android kernel, and CVE-2025-48543, an elevation of privilege issue in the Android Runtime component, with indications that they may be under limited, targeted exploitation.

In addition, four other critical-severity problems are fixed in this patch, including CVE-2025-48539, a remote code execution flaw in Android’s System component, and CVE-2025-21450, CVE-2025-21483, and CVE-2025-27034, which affect Qualcomm components.

According to Qualcomm via its bulletin, CVE-2025-21483 is a memory corruption flaw in the data network stack that can be triggered by reassembling video (NALUs) from RTP packets, while CVE-2025-27034 is an array index validation bug in the multi-mode call processor during PLMN selection from the SOR failed list. The update, which covers Android 13 through 16, brings the total fixed flaws to 111 and advises users to upgrade to security patch level 2025-09-01 or 2025-09-05. Samsung has also issued its September maintenance update for its devices, including fixes for region-specific components.