Google Fixes 107 Android Vulnerabilities, Addresses Two Active Zero-Day Attacks
Google released its monthly security update for Android. This time, two vulnerabilities have been addressed that have already been exploited by hackers in the “wild”, that is, in the real world.
In total, these patches fix 107 security flaws across various parts of Android, such as the Framework, System, and Kernel, and components from some chipset makers like Arm, Qualcomm, MediaTek, Imagination Technologies, and Unison.
The two specific vulnerabilities that have now been exploited are:
CVE-2025-48633: An information disclosure vulnerability in the Framework (meaning sensitive data could be leaked)
CVE-2025-48572: An elevation of privilege vulnerability in the Framework (meaning a hacker could gain administrator-level control over a normal user)
However, Google, as is customary, hasn’t provided any details, such as how these attacks were exploited, whether they were chained together or separately, or how many people were affected. It’s also unknown who is behind these attacks.
Google also acknowledged in its advisory that both of these vulnerabilities (CVE-2025-48633 and CVE-2025-48572) could be used for “limited, targeted exploitation.” This means that this isn’t a large-scale attack, but rather a targeting of specific individuals or organisations.
In addition, in the December 2025 updates, Google also fixed a critical vulnerability CVE-2025-48631 in the Framework component. Using this vulnerability, any attacker could remotely take down a device (Remote Denial-of-Service), and the important thing is that it doesn’t require any extra permissions or privileges. All it takes is a network connection.
The December security bulletin provides two patch dates:
2025-12-01
2025-12-05
This means device manufacturers have some flexibility; they can quickly fix some common vulnerabilities on the first patch date (December 1st), and bring the rest to an update by December 5th.
But users are advised to update their phones as soon as the update arrives, especially if their device may already be vulnerable.
And yes, all of this comes just three months after Google released fixes for two more actively exploited vulnerabilities in the Linux Kernel (CVE-2025-38352) and the Android Runtime (CVE-2025-48543). Both had a CVSS score of 7.4, which falls in the “high” severity category, and both could lead to local privilege escalation – meaning an app or user could escalate their permissions to system-level access.
Found this article interesting? Explore more ransomware security insights and threat updates.
Did You Know
Google Fixes 107 Android Vulnerabilities
107 security bugs have been fixed by the December 2025 security update in the multiple parts of Android from the Framework to Kernel and the third-party chipset components (Qualcomm, MediaTek, Arm). Two zero-day security vulnerabilities account for the in-the-wild exploitation of these vulnerabilities, according to Google.
The two actively exploited flaws impact Android versions 13, 14, 15, and 16. That means a very large portion of modern Android phones and tablets could be vulnerable until they receive the update.
One vulnerability can cause information disclosure (leaking sensitive data), and the other allows elevation of privilege — meaning a malicious app or actor could gain higher-level access than intended on a device. This elevates the risk of spyware, unauthorized access, or further attacks.
Check your device’s Security Patch Level in Settings. The update you want to see is 2025-12-05 or later, that indicates your phone has received the fixes for all 107 issues. If it’s older, you may still be vulnerable.
Update and install any pending updates. If possible, enable automatic updates so you don’t miss critical security patches in the future.
Fixing a vulnerability doesn’t help users until their specific phone model and carrier actually receive the patch. Android fragmentation means updates roll out at different times depending on the manufacturer, carrier, and region — so many devices remain vulnerable long after Google releases a fix.
No. While Google issues the patches, device manufacturers and carriers must integrate and distribute them to phones. Some devices (e.g., Pixels) may get updates quickly; others (Samsung, Motorola, etc.) may take days to weeks longer. That delay creates a window of risk.
Google’s advisory notes that the two zero-day bugs may be under limited, targeted exploitation — usually meaning attackers are using them in focused espionage or spyware campaigns rather than broad mass attacks.
Both. Exploited vulnerabilities can expose sensitive data stored on your device and potentially let attackers install more dangerous malware or gain deeper control. That’s why applying the update as soon as it’s available is crucial for both personal privacy and overall security.
Call Now — 24/7 Ransomware Help
If you’re under attack, call now. We’ll start safe containment, preserve evidence, and stand up a clean landing zone. No contracts required to start.
Call 316‑712‑4006
I am at risk, Save me!