Android Zero-Day Under Attack: Google Issues Urgent Patch for Privilege Escalation Flaw - CyberNetSec.io

Print

Home

AdvisoryAndroid Zero-Day Under Attack: Google Issues Urgent Patch for Privilege Escalation Flaw

Articles

Google Patches Actively Exploited Android Zero-Day (CVE-2025-48595) in June Security Update

Android Zero-Day Under Attack: Google Issues Urgent Patch for Privilege Escalation Flaw<br>HIGHJune 2, 2026<br>5m read

VulnerabilityMobile SecurityPatch Management

Related Entities<br>Organizations<br>Google Qualcomm

Products & Tech<br>Android

CVE Identifiers<br>CVE-2025-48595<br>HIGH<br>CVEDetails.com CVE.org

CVE-2025-65018<br>CRITICAL<br>CVEDetails.com CVE.org

CVE-2026-0043<br>CRITICAL<br>CVEDetails.com CVE.org

CVE-2026-0097<br>CRITICAL<br>CVEDetails.com CVE.org

CVE-2026-21352<br>CRITICAL<br>CVEDetails.com CVE.org

CVE-2026-21353<br>CRITICAL<br>CVEDetails.com CVE.org

CVE-2025-47392<br>CRITICAL<br>CVEDetails.com CVE.org

CVE-2026-25276<br>CRITICAL<br>CVEDetails.com CVE.org

CVE-2026-25277<br>CRITICAL<br>CVEDetails.com CVE.org

MITRE ATT&CK Techniques<br>T1068

Exploitation for Privilege Escalation<br>T1404

Execution through API

Full Report

Export Markdown

Executive Summary

Google has released its June 2026 security update for the Android operating system, patching a total of 124 vulnerabilities. The most critical fix addresses CVE-2025-48595 , a high-severity Elevation of Privilege (EoP) vulnerability in the Android Framework that is being actively exploited in the wild. Google has confirmed the flaw is subject to "limited, targeted exploitation." A successful attack could allow a malicious application to gain system-level privileges, completely compromising the security of the device. The update also includes patches for 18 other critical vulnerabilities. Due to the active exploitation, users are strongly advised to apply the June 2026 security patch as soon as their device manufacturer makes it available.

Vulnerability Details

The primary vulnerability of concern is:

CVE-2025-48595 : An Elevation of Privilege (EoP) vulnerability in the Android Framework. This is a high-severity flaw that requires a local attacker (e.g., a malicious app installed by the user) to exploit. Successful exploitation allows the attacker to escalate their privileges, potentially to the level of the operating system (SYSTEM), enabling them to bypass Android's security model, access sensitive data, and execute arbitrary code.

Google has not disclosed technical details about the vulnerability or the nature of the in-the-wild attacks to prevent wider exploitation. Such zero-day flaws are frequently used by commercial spyware vendors and nation-state actors for targeted surveillance.

Other Critical Vulnerabilities

The June 2026 bulletin also addresses several other critical flaws, including:

CVE-2025-65018 : A critical remote privilege escalation flaw, also in the Framework component, which could be exploited without user interaction.

Multiple critical flaws in the System component and Qualcomm closed-source components that could lead to privilege escalation or remote code execution.

Affected Systems

Actively Exploited Flaw (CVE-2025-48595) : Affects Android versions 14, 15, and 16.

Other Vulnerabilities : Affect a wide range of Android OS versions and components.

The update is being delivered in two patch levels:

2026-06-01 : Addresses vulnerabilities in core Android components.

2026-06-05 : A comprehensive patch level that includes the 2026-06-01 fixes plus patches for third-party and kernel components.

Google Pixel devices are typically the first to receive these updates, with other manufacturers like Samsung, OnePlus, and others following over the subsequent weeks and months.

Exploitation Status

Active Exploitation Confirmed . Google's bulletin explicitly states there are "indications that CVE-2025-48595 may be under limited, targeted exploitation." This elevates the urgency of patching significantly. While the scope is described as "limited," any actively exploited zero-day poses a serious threat.

MITRE ATT&CK Techniques

T1068 - Exploitation for Privilege Escalation : The core of the CVE-2025-48595 exploit, allowing a low-privilege app to gain higher system rights.

T1404 - Execution through API : The malicious app would likely interact with a vulnerable API within the Android Framework to trigger the flaw.

Impact Assessment

A successful exploit of CVE-2025-48595 could have severe consequences for an affected user. An attacker with system-level privileges can:

Access all data on the device, including emails, messages, photos, and banking app data.

Bypass all application sandboxing and permissions.

Install persistent malware or spyware that survives a reboot.

Activate the microphone and camera to spy on the user.

Steal credentials stored on the device.

Given that the exploitation is targeted, the immediate risk to the general population is lower than a widespread attack. However, the existence of the exploit means it could be incorporated into more...