Google addressed two Android flaws actively exploited in targeted attacks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-38352 | Actively Exploited TOCTOU Race Condition in Linux Kernel POSIX CPU Timers | 7.8 | 1% | KEVPoC ×2 | KEV |
| CVE-2025-48539 | In SendPacketToPeer of acl_arbiter.cc, there is a possible out of bounds read due to a use after free | 8.0 | <1% | ||
| CVE-2025-48543 | Use-After-Free in Android Runtime Enables Sandbox Escape and Local Privilege Escalation | 8.8 | <1% | KEV | KEV |
From the original article
1 min read at securityaffairs.com
Google addressed 120 Android vulnerabilities in September 2025, including two flaws actively exploited in targeted attacks. Google has released security updates to address 120 Android vulnerabilities as part of Android Security Bulletin – September 2025 . Two of these vulnerabilities have been exploited in targeted attacks.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.