Android Hit by 0-Click RCE Vulnerability in Core System Component

Google has disclosed a critical remote code execution vulnerability, tracked as CVE-2025-48593, in Android’s System component that requires no user interaction to exploit. The flaw affects Android versions 13 through 16, allowing an attacker to remotely run code on a vulnerable device from the ground up, with no elevated privileges needed.

According to Google’s Android Security Bulletin, the issue is the most severe in this month’s update cycle, and devices could be at risk unless they receive patches dated 2025-11-01 or later. Patches have been provided through Android Open Source Project repositories, and device manufacturers are urged to roll out updates to users accordingly; users should verify their patch level in Settings.

The bulletin also mentions a related vulnerability, CVE-2025-48581, an elevation of privilege flaw affecting Android 16, though it poses less immediate risk than the RCE issue.