Android Security Update: Google discovered zero-day vulnerabilities and in response released the Android Security Bulletin for September 2025 (patch level 2025-09-05) to protect millions of devices.
The bulletin describes critical issues in both System and Kernel components and emphasizes the importance of immediate updates to mitigate remote code execution risks.
Android Security Update: CVE-2025-38352
The main fix addresses CVE-2025-38352, a zero-interaction in the Android System component that allows remote code execution without elevated privileges. Google rates the vulnerability “Critical,” noting that successful exploitation could give attackers complete control over affected devices, even with mitigations enabled in development environments.
See also: Hackers leverage Hexstrike-AI for Zero Day exploit
The most concerning aspect is that no user interaction is required, such as clicking a link or opening a file.
The fixes for CVE-2025-38352 are now available in the Android Open Source Project (AOSP) repository.
Google plans to update the bulletin with direct AOSP links within 48 hours of publication.
Android Security Update: CVE-2025-48543
Another fix targets CVE-2025-48543, an Elevation of Privilege (EoP) vulnerability in the Android kernel. Rated “High severity,” this flaw could allow local code to gain root-level privileges, bypassing SELinux policies and other kernel-level safeguards.
Affected versions include Android 13, 14, 15, and 16.Partners have been notified of the two issues for at least a month, ensuring that OEMs can incorporate the necessary kernel fixes into upcoming device updates.
See also: PoC Exploit for RCE vulnerability in IIS Web Deploy
Users are advised to verify that the patch level is at least 2025-09-05 and apply the updates immediately. Android partners have been notified and AOSP patches will be released shortly. This coordinated effort underscores Google's commitment to proactive vulnerability management and rapid response to emerging threats. Users and device manufacturers should prioritize this update to maintain the security integrity of Android.
The release of the September 2025 Android Security Bulletin once again highlights how dynamic and unpredictable the mobile security landscape is. The existence of a zero-day with zero user interaction highlights the most worrying scenario: a device can be compromised silently, without any warning signs. This means that the concept of “safe use” is no longer enough; even the most careful users remain exposed if their devices are not updated in a timely manner.
Meanwhile, the second kernel vulnerability exposes the perennial problem of complexity in the Android ecosystem. With dozens of versions, different OEMs, and inconsistent patch distribution rates, the issue is not just technical but also organizational. Google may provide the code to AOSP immediately, but real security depends on when—or if—manufacturers integrate the fixes.
See also: CISA: New TP-Link and WhatsApp vulnerabilities in the KEV Catalog
On the positive side, Google seems to have adopted a more coordinated strategy: timely partner updates, transparency, and rapid code release. However, this does not reduce the individual responsibility of users to check the security level of their device and prefer models that receive long-term support.
In the broader context, the case shows that security in open source operating systems requires constant vigilance. Any delay in distributing patches is a window of opportunity for cybercriminals. Thus, the discussion about Android security cannot be limited to the software level, but must also extend to the responsibility of manufacturers to protect their customers in a timely and consistent manner.
