Android Security Bulletin: September 2025 Update

In its recent Android Security Bulletin, Google has announced the resolution of 111 distinct security vulnerabilities, including two critical zero-day vulnerabilities that have been actively exploited in targeted attacks. The most alarming among these are identified as CVE-2025-48543, a flaw in the Android Runtime, and CVE-2025-38352, a vulnerability in the Linux kernel.

Understanding the Vulnerabilities

According to Google’s advisory, both CVE-2025-48543 and CVE-2025-38352 are classified as elevation of privilege (EoP) vulnerabilities. These issues permit attackers to gain heightened system privileges on Android devices without requiring any user interaction or additional execution rights. Google highlighted that there are indications these vulnerabilities may be under limited, targeted exploitation, elevating the severity of the concerns.

While specifics regarding the potential attackers or the contexts of these exploits have not been disclosed, Google’s acknowledgment of the ongoing exploitation underscores the urgency for users to update their devices promptly.

CVE-2025-48543: Android Runtime Vulnerability

This particular vulnerability affects the Android Runtime (ART) and has been rated as “high” in severity. It impacts devices running Android versions 13 through 16. This flaw allows an attacker to escalate privileges locally without any input from the user. Google has addressed this issue through Google Play system updates, ensuring that devices with Google Mobile Services (GMS) receive necessary protections, even outside standard OTA (over-the-air) updates.

CVE-2025-38352: Linux Kernel Race Condition

The second significant vulnerability, CVE-2025-38352, originates in the Linux kernel, specifically linked to the management of POSIX CPU timers. It is attributed to a race condition that could potentially be exploited for local privilege escalation. This vulnerability was first publicly patched in July 2025, and major Linux distributions have since implemented fixes. Android devices that utilize this kernel version are now being updated through the September patch rollout. Google rates this vulnerability as “high” due to its capacity to compromise device integrity, requiring minimal effort from attackers.

Overview of the September 2025 Patch

The September 2025 Android Security Bulletin offers a detailed overview of the vulnerabilities addressed, categorized by their respective components. This month’s release touches on various flaws affecting Android Runtime, Framework, System, Kernel, and third-party components from manufacturers like MediaTek, Qualcomm, Arm, and Imagination Technologies.

Among the critical vulnerabilities patched this month is CVE-2025-48539, a remote code execution (RCE) flaw within the System component that enables attackers to execute code remotely without requiring user interaction.

Breakdown of Vulnerability Types

Of the 111 vulnerabilities that were patched, several notable points stand out:

• Many of the vulnerabilities are EoP issues that do not necessitate user involvement.
• A number of denial of service (DoS) vulnerabilities were resolved, including CVE-2025-48538 and CVE-2025-48542, which affect Android versions 13 through 16.
• Critical patches applied to components such as Widevine DRM, WiFi, and Google Play system further enhance user security.

Importance of Timely Updates

In the September 2025 Android update, Google has highlighted the persistent threat posed by privilege escalation attacks, notably through active exploits like CVE-2025-48543 and CVE-2025-38352. These threats reinforce the necessity for users to maintain their devices with the latest updates.

While protections like Google Play Protect aid in mitigating numerous risks, it’s crucial for users to install the most recent patches and steer clear of unverified applications. Developers can expect AOSP patches delivered within 48 hours; all users are encouraged to ensure their devices are updated to the 2025-09-05 patch level or later for optimal security.

Maintaining awareness and acting swiftly on security updates remains essential for safeguarding personal data and enhancing device integrity in an increasingly digital world.