Google Patches 124 Android Flaws, Including Exploited Zero-Day
Summary
Google's June 2026 Android update fixes 124 vulnerabilities, including CVE-2025-48595, which it says may be under limited, targeted exploitation. The flaw affects Android 14 and later; the update has two patch levels.
Key points
- Google's June 2026 Android security update addresses 124 vulnerabilities.
- Google says CVE-2025-48595, a high-severity Android Framework flaw, may be under limited, targeted exploitation.
- The flaw could let local attackers execute code and escalate privileges on Android 14 or later; Google has not shared technical details about the attacks.
- The update fixes 18 critical issues across Android System, Framework, and Qualcomm components.
- Google issued patch levels 2026-06-01 and 2026-06-05; the latter includes the first batch plus additional kernel and third-party component fixes.
- Pixel devices are expected to receive the updates immediately, while other vendors may take longer to adapt them.
Article Details
- Event Type
- Google released the June 2026 Android security update, patching 124 vulnerabilities, including a zero-day reported to be under limited, targeted exploitation.
- Impact
- CVE-2025-48595 affects Android 14 or later and could allow a local attacker to execute code and escalate privileges. The update also fixes 18 critical vulnerabilities across System, Framework, and Qualcomm components, including issues that could enable denial of service or privilege escalation. Google issued patch levels 2026-06-01 and 2026-06-05; Pixel devices receive the updates immediately, while updates for other vendors’ devices may take longer.
CVE
Vendors
GoogleGoogle has released the June 2026 Android security patches to fix 124 vulnerabilities, including CVE-2025-48595, a zero-day flaw that is being exploited in targeted attacks.QualcommThe update also addresses multiple critical issues across Android System, Framework, and Qualcomm components, with Google urging users to update as soon as possible.