Trending Now - Google Addresses 124 Android Security Flaws, Including Zero-day
WHO:
BleepingComputer - Google is the organization addressing the security vulnerabilities.
WHAT:
BleepingComputer - Google has fixed 18 critical vulnerabilities across System, Framework, and Qualcomm closed-source components that attackers can abuse to trigger denial-of-service conditions and elevate privileges on unpatched Android devices.
BleepingComputer - The most severe of these issues is a critical security vulnerability in the Framework component that could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
BleepingComputer - Google released patches for two other high-severity zero-days (CVE-2025-48633 and CVE-2025-48572) in December, and for another zero-day flaw in a Qualcomm display component (CVE-2026-21385) in March, all of which were tagged as "under limited, targeted exploitation."
Mashable - Google patched 100+ security vulnerabilities in Android.
BleepingComputer - Google released patches for 124 vulnerabilities, including one zero-day flaw.
BleepingComputer - The zero-day flaw is tracked as CVE-2025-48595 and is actively exploited in targeted attacks.
BleepingComputer - Google fixed 18 critical vulnerabilities that could lead to denial-of-service conditions and privilege escalation.
BleepingComputer - Google issued two sets of patches: the 2026-06-01 and 2026-06-05 security patch levels.
WHERE:
BleepingComputer - The vulnerabilities affect devices running Android 14 or later.
WHEN:
BleepingComputer - The Android security patches were released in June 2026.
BleepingComputer - The security patch levels are dated 2026-06-01 and 2026-06-05.
WHY:
BleepingComputer - The patches were released to address vulnerabilities that could be exploited by attackers, including commercial spyware and nation-state operations.
HOW:
BleepingComputer - Google Pixel devices will receive these security updates immediately, while other vendors will often take longer to test and tweak them for specific hardware configurations.
BleepingComputer - Google encourages users to update to the latest version of Android to mitigate exploitation risks.
BleepingComputer - The vulnerabilities were addressed through security updates that include fixes for closed-source third-party and kernel subcomponents.
(UPDATED June 2, 2026 23:30 UTC)
Google has addressed 18 critical vulnerabilities in its System, Framework, and Qualcomm closed-source components that could allow attackers to trigger denial-of-service conditions and elevate privileges on unpatched Android devices. The most severe of these vulnerabilities is in the Framework component, which could enable remote escalation of privilege without requiring any user interaction. While Google Pixel devices will receive these security updates immediately, other vendors may take longer to test and adapt the patches for their specific hardware configurations.
--
(UPDATED June 2, 2026 20:09 UTC)
Google has patched over 124 security vulnerabilities in Android, including a critical zero-day flaw tracked as CVE-2025-48595, which is currently being exploited in targeted attacks. The updates, released as part of the 2026-06-01 and 2026-06-05 security patch levels, address issues that could lead to denial-of-service conditions and privilege escalation on devices running Android 14 or later. Users are encouraged to update to the latest version of Android to mitigate the risks associated with these vulnerabilities, which could be exploited by attackers, including commercial spyware and nation-state operations.