{"id":514702,"date":"2026-06-02T13:18:18","date_gmt":"2026-06-02T13:18:18","guid":{"rendered":"https:\/\/www.europesays.com\/ie\/514702\/"},"modified":"2026-06-02T13:18:18","modified_gmt":"2026-06-02T13:18:18","slug":"google-fixes-actively-exploited-android-vulnerability-cve-2025-48595","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ie\/514702\/","title":{"rendered":"Google fixes actively exploited Android vulnerability (CVE-2025-48595)"},"content":{"rendered":"<p>Google has <a href=\"https:\/\/source.android.com\/docs\/security\/bulletin\/2026\/2026-06-01\" target=\"_blank\" rel=\"nofollow noopener\">announced<\/a> the June 2026 Android security updates, which fix a bucketload of vulnerabilities, including a high-severity vulnerability (CVE-2025-48595) in the Android Framework that \u201cmay be under limited, targeted exploitation.\u201d<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2026\/06\/android-650.webp\" class=\"aligncenter\" alt=\"CVE-2025-48595 exploited\" title=\"Android\"\/><\/p>\n<p>About CVE-2025-48595<\/p>\n<p>CVE-2025-48595 is an integer overflow vulnerability in the Android Framework, a set of APIs and system services that apps interact with directly.<\/p>\n<p>The flaw allows attackers to escalate privileges on a vulnerable device, and they may gain complete access to the device and data on it.<\/p>\n<p>Successful exploitation does not hinge on user interaction, and the attack vector is local, which most likely means that the vulnerability is being exploited via a malicious app that targeted users have been tricked into installing. <\/p>\n<p>CVE-2025-48595 is present across Android versions 14, 15, 16, and 16-qpr2 (Quarterly Platform Release 2).<\/p>\n<p>The vulnerability\u2019s NVD <a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2025-48595\" target=\"_blank\" rel=\"nofollow noopener\">description<\/a> seems to suggest that there are several vulnerable code paths, and hopefully Google\u2019s patch has closed all of them off.<\/p>\n<p>More vulnerabilities addressed<\/p>\n<p>The June 2026 security updates will also patch other critical and high-severity vulnerabilities in the Android Framework, System (core Android daemons and services), Google Play system components, the Linux kernel, and third-party chipset components.<\/p>\n<p>Core Android OS fixes are addressed at patch level 2026-06-01, while devices running patch level 2026-06-05 or later will receive the full set of fixes, including those for kernel and chipset components.<\/p>\n<p>\u201cWe notify our Android partners of all issues at least a month before publishing the bulletin,\u201d Google noted, and said that Android device and chipset manufacturers may also publish security vulnerability details specific to their products.<\/p>\n<p>\u201cWithin 48 hours after the initial publication of this bulletin, we will release the corresponding source code patches to the Android Open Source Project (AOSP) repository,\u201d the company added.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2025\/09\/devider.webp.webp\"\/><\/p>\n<p><strong>Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. <a href=\"https:\/\/www.helpnetsecurity.com\/newsletter\/\" rel=\"nofollow noopener\" target=\"_blank\">Subscribe here!<\/a><\/strong><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2025\/09\/devider.webp.webp\"\/><\/p>\n","protected":false},"excerpt":{"rendered":"Google has announced the June 2026 Android security updates, which fix a bucketload of vulnerabilities, including a high-severity&hellip;\n","protected":false},"author":2,"featured_media":514703,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":"","_share_on_mastodon":"0"},"categories":[74],"tags":[821,223018,18,19,17,202755,82,27983],"class_list":["post-514702","post","type-post","status-publish","format-standard","has-post-thumbnail","category-technology","tag-android","tag-cve","tag-eire","tag-ie","tag-ireland","tag-security-update","tag-technology","tag-vulnerability"],"share_on_mastodon":{"url":"https:\/\/pubeurope.com\/@ie\/116680715057296284","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/514702","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/comments?post=514702"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/514702\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media\/514703"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media?parent=514702"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/categories?post=514702"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/tags?post=514702"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}