Back Hkcert

Android Multiple Vulnerabilities

Hkcert • June 2, 2026

Multiple vulnerabilities were identified in Android. A remote attacker could exploit some of these vulnerabilities to trigger denial of service condition, elevation of privilege, remote code execution and sensitive information disclosure on the targeted system.

CVE-2025-48595 is being scattered exploited. This vulnerability could lead to escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Hence, the risk level is rated as Medium Risk.

Before installation of the software, please visit the vendor web-site for more details.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Android Zero-Day Exploited: 124 Vulnerabilities Patched Google has released security updates addressing 124 vulnerabilities in Android, including a critical zero-day flaw (CVE-2025-48595) that is actively exploited in targeted attacks. This vulnerability allows local attackers to escalate privileges without user interaction on devices running Android 14 or later. The updates also include fixes for other critical vulnerabilities in the Framework, System, and Qualcomm components. Users are urged to update their devices to the latest security patch levels (2026-06-01 or 2026-06-05) to mitigate risks. The vulnerabilities affect a wide range of Android devices, with Google Pixel devices receiving updates immediately. Third-party manufacturers may take longer to release patches. The ongoing exploitation of CVE-2025-48595 raises concerns about potential widespread impacts, especially given its critical nature. 50 sources 73

Extracted Entities

Android Multiple Vulnerabilities

The full story

Extracted Entities

Attack Types (3)

CVEs (1)

CWE Weaknesses (2)

MITRE ATT&CK (2)

Platforms (1)