Google Patches 107 Android Flaws, Including Two Framework Bugs Exploited in the Wild
Summary: Google released its December 2025 Android security updates on Monday, addressing 107 flaws across Framework, System, Kernel, and components from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unison, including two high-severity bugs it said have been exploited in the wild. Google gave no details on the nature of the attacks, whether the two flaws were chained or used separately, or who is behind them, saying only that there are indications of 'limited, targeted exploitation'; the update also fixes a critical Framework remote denial-of-service flaw (CVE-2025-48631) and ships in two patch levels, 2025-12-01 and 2025-12-05.
Key Takeaway: CISA added CVE-2025-48572 and CVE-2025-48633 to its KEV catalog on December 2, 2025, requiring federal civilian agencies to patch by December 23 - a deadline that assumes the two exploited flaws are already in use against real targets.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-38352CVE-2025-48543CVE-2025-48572CVE-2025-48631CVE-2025-48633
- Related
- Microsoft Patch Tuesday, September 2025 Edition Cyber Risks ·