Husain Parvez
Published on: September 10, 2025
Google has released its largest Android security update of 2025, pushing out more than 120 fixes, including patches for two vulnerabilities that are already under active attack.
The company confirmed that “there are indications that the following may be under limited, targeted exploitation: CVE-2025-38352, CVE-2025-48543.” Both flaws allow attackers to escalate privileges without user interaction. The first affects the Linux kernel, while the second lies in Android’s runtime environment. Hong Kong’s Computer Emergency Response Team echoed Google’s warning, stating that “CVE-2025-38352 and CVE-2025-48543 are being scattered [sic] exploited.”
In addition to the actively exploited bugs, the September bulletin addresses a critical remote code execution issue in Android’s System component, tracked as CVE-2025-48539, which could let attackers compromise devices remotely.
The update also resolves three critical vulnerabilities in Qualcomm components, including CVE-2025-21450 in its GPS control system, CVE-2025-21483 in mobile data stacks, and CVE-2025-27034 in its call processor. Qualcomm recently extended support for its components to eight years, while Google provides seven years of updates for Pixel devices.
Other vendors are included as well, with Imagination Technologies receiving fixes for 10 high-severity flaws in its PowerVR GPU drivers. Most of the remaining issues patched this month are rated high severity.
While Pixel phones receive updates immediately, the broader Android ecosystem faces delays. The Register noted that “the two biggest Android players in the US are Samsung and Motorola, and they will roll these fixes out when they are good and ready.” With Google holding only about four percent of the US smartphone market, millions of users will have to wait for manufacturers to distribute the patches.
Security experts recommend installing updates as soon as they are available to reduce exposure to ongoing attacks, particularly given the active exploitation of two of this month’s flaws.
