Google addressed two Android flaws actively exploited in targeted attacks

Google has issued security updates to address 120 Android vulnerabilities as part of Android Security Bulletin – September 2025, noting that two of these flaws were exploited in targeted attacks. The advisory identifies CVE-2025-38352, a privilege escalation flaw in the Linux Kernel component (CVSS 7.4), and CVE-2025-48543, a privilege escalation flaw in the Android Runtime component, as those under limited, targeted exploitation.

According to Security Affairs, these flaws enable local privilege escalation without requiring extra permissions or user interaction. Benoît Sevens of Google’s Threat Analysis Group (TAG) is credited with discovering CVE-2025-38352, a finding described as suggesting possible exploitation by advanced threat actors in spyware campaigns. Google released two Android security patch levels (2025-09-01 and 2025-09-05) to help partners address the shared vulnerabilities quickly, and urged users to apply the latest patches.