Android Security Alert: Google Patches 120 Flaws, Including Two Zero-Days Under Attack
Summary: Google released September 2025 Android security updates addressing 120 flaws, including two zero-days that it said have been exploited in limited, targeted attacks. Both zero-days allow local escalation of privilege with no user interaction required, and Google's Threat Analysis Group's Benoît Sevens is credited with reporting the upstream Linux Kernel flaw, which may have been used in targeted spyware attacks.
Key Takeaway: Two flaws that need no user interaction and no extra privileges to escalate are already being exploited in targeted attacks, and Google has not disclosed how they were weaponized or whether they were used together.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-21479CVE-2025-27038
- Related
- ⚡ Weekly Recap: Chrome 0-Day, Data Wipers, Misused Tools and Zero-Click iPhone Attacks Cyber Risks ·CVE-2025-27038: Qualcomm Multiple Chipsets Use-After-Free Vulnerability Known Exploited Vulnerabilities · Jun 03, 2025CVE-2025-21479: Qualcomm Multiple Chipsets Incorrect Authorization Vulnerability Known Exploited Vulnerabilities · Jun 03, 2025