Android drops mega patch bomb – 120 fixes, two already exploited

Patch Tuesday is next week, but Android is ahead of the game, dropping its biggest patch bundle this year while attackers actively exploit two of the now-fixed flaws.

This month, the world’s most popular mobile operating system pushed out 120 patches, its biggest monthly dump this year. It’s a far cry from July, when Android didn’t issue a single patch as everything was apparently fine, but in September, two of the flaws may be under “limited, targeted exploitation.”

The two biggest concerns are CVE-2025-38352, a high-severity problem with the Linux kernel at the heart of the operating system, and CVE-2025-48543, a high-severity issue with Android’s runtime environment hosting apps. An attacker can escalate local privileges with both flaws, without even requiring user interaction.

Google declined to name who is exploiting the flaws or how, but the language suggests that a surveillanceware company is using them to break in. We asked noted flaw-finders Citizen Lab at the University of Toronto, but they say that they haven’t detected anyone using the vulns. However, the Hong Kong computer emergency response team issued an alert and echoed Google’s warning, noting there are signs of limited, targeted exploitation.

“CVE-2025-38352 and CVE-2025-48543 are being scattered [sic] exploited,” it warned.

September’s update also includes three critical vulnerabilities in Qualcomm’s closed-source components. CVE-2025-21450 is a CVSS 9.1-rated vulnerability in its GPS control system, CVE-2025-21483 covers issues with network data stacks, and CVE-2025-27034 involves an issue with Qualcomm’s multi-mode call processor.

Qualcomm has, possibly under pressure from Google, been upping its flaw-fixing game. In February, it doubled the length of time it would support its components from four to up to eight years. Google, by contrast, guarantees seven years of OS and security updates for its own Pixel 8 line and later.

Imagination Technologies is also getting 10 fixes, all in its PowerVR GPU and all high severity.

Most of the remaining Android flaws are rated high severity, though there’s also a critical remote code execution hole in the System component (CVE-2025-48539), so the update should be installed as soon as possible. But therein lies the problem. While owners of Google’s Pixel handset line will get prompt patching, that’s only a fraction of the vulnerable handsets, with the Chocolate factory only having around a four percent market share in the US.

The two biggest Android players in the US are Samsung and Motorola, and they will roll these fixes out when they are good and ready. We’ve asked both mobile makers when people will get a fix for these active vulnerabilities and will update you if we hear back. ®

READ MORE HERE