Google Seals Major Android Security Flaws: 120 Vulnerabilities Patched, Including Two Active Zero-Days

Google has urgently released its September 2025 Android Security Update, addressing a staggering 120 vulnerabilities across the platform. Most alarmingly, two of these flaws are zero-day vulnerabilities already under targeted exploitation. This patch release underscores the escalating urgency of maintaining Android’s security in an increasingly hostile cyber landscape.

Rapid Response to Active Threats

In its latest monthly bulletin, Google fixed 120 security flaws, notably including two privilege escalation vulnerabilities—CVE‑2025‑38352 (a Linux Kernel issue, CVSS score: 7.4) and CVE‑2025‑48543 (within the Android Runtime component, score not rated)—both allowing local privilege elevation without needing user interaction or elevated execution rights.

Although Google has not disclosed specifics about how these vulnerabilities were being exploited, its advisory confirms indications of “limited, targeted exploitation.” Notably, the Linux Kernel flaw was discovered by Benoît Sevens from Google’s Threat Analysis Group (TAG), hinting at potential use in spyware campaigns.

Background Context: Severity & Distribution Challenges

Addressing 120 flaws in a single update reflects the complexity of securing Android’s vast, fragmented ecosystem. The dual nature of the fixed vulnerabilities—kernel and runtime—highlights the layered risks across device architecture. The absence of requisite user interaction for these exploits further raises the stakes for compromised environments.

Distribution remains a significant concern: while Google publishes the fixes swiftly, device manufacturers and OEMs must package them, and often there are delays before end-users actually receive these patches. For many older or budget devices, updates may never arrive—a perennial challenge in Android security.

Expert Insights

• From Google TAG: Benoît Sevens’s role suggests that the Linux Kernel vulnerability may have been weaponized in real-world spyware operations. The advisory’s mention of targeted exploitation should prompt heightened vigilance, especially among sectors handling sensitive data .
• Android Device Fragmentation: Past episodes like the “Stagefright” vulnerability illustrated how delays in patch propagation can leave devices exposed for extended periods. It remains critical that manufacturers prioritize rapid rollouts and communicate clearly with users.

Conclusion

Google’s September 2025 security update represents a critical intervention, mitigating active threats via zero-day vulnerabilities in Android. Yet, the real test lies in patch adoption. Protecting users depends not only on timely patch releases from Google but also on swift implementation by OEMs and awareness among users to apply updates promptly. In the ongoing battle to secure Android devices, this patch rollout is a must-install—but only if users and industry partners act without delay.