Android Security Alert: Google Patches 120 Flaws, Including Two Zero

CVE-2025-21479 is an incorrect authorization flaw (CWE-863) in Qualcomm chipset firmware that allows unauthorized command execution in a GPU micronode, causing memory corruption when the GPU processes a specific sequence of commands. Because the CVSS vector is local (AV:L) with user interaction required, exploitation most plausibly involves a malicious local application or process driving the GPU through the vulnerable command sequence. An attacker who successfully triggers the flaw gains high-impact confidentiality, integrity, and availability effects with scope change, meaning the compromise can extend beyond the GPU component to the broader device. Affected products span Qualcomm AQT1000, FastConnect 6200/6700/6800/6900/7800, QCA6391, QCM4490, QCS4490, Snapdragon 855 (SD855), SM4635, and SM6250 firmware, i.e., chipsets used in Android smartphones and IoT/industrial devices. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-06-03, and news reports describe limited, targeted Android attacks exploiting Qualcomm GPU zero-days fixed in Google's 2025 Android security updates.

Do: Apply Qualcomm's fix by installing the Android security update from June 2025 or later (or the OEM/vendor firmware update for QCM4490, QCS4490, FastConnect, and other affected chipsets), checking your device's security patch level and chipset firmware against Qualcomm's bulletin, which lists the exact fixed versions. Organizations subject to BOD 22-01 must apply vendor mitigations per CISA's KEV required action or discontinue use of affected products; there is no known public PoC, but exploitation in targeted attacks is confirmed, so prioritize patching internet-facing and user-facing Android fleets.

CVE-2025-38352 is a time-of-check to time-of-use (TOCTOU) race condition (CWE-367) in the Linux kernel's POSIX CPU timers subsystem: when an exiting non-auto-reaping task has passed exit_notify() and handles CPU timers from interrupt context, it can be reaped by its parent or debugger right after unlock_task_sighand(), so a concurrent posix_cpu_timer_del() cannot detect that the timer is firing (cpu_timer_task_rcu() and/or lock_task_sighand() fail). A local attacker with low privileges who can manipulate POSIX CPU timers on such a task can win this race window, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8, local vector, no user interaction). Any system running an affected Linux kernel is exposed, including Debian GNU/Linux deployments and Android devices built on the kernel; practical reachability is limited where CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y routes timer handling through task work instead of IRQ context. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-04 and Google shipped it as an actively exploited fix in the September 2025 Android security update; EPSS currently estimates a 1.3% probability of exploitation within 30 days (68th percentile), and a public proof-of-concept is available.

Do: Apply updated kernel packages from your distribution (Debian and other vendors ship the upstream posix-cpu-timers fix) and install Google's September 2025 Android security patch on Android devices; CISA KEV listing requires federal agencies to apply vendor mitigations or discontinue use per BOD 22-01. Because exploitation requires local code execution, prioritize multi-tenant servers, build/CI hosts, and devices where untrusted users or apps run local code. A public proof-of-concept (github.com/farazsth98/chronomaly) is available for validation testing.

CVE-2025-48543 is a use-after-free (CWE-416) in the Android Runtime that exists in multiple code locations and allows an attacker who has already achieved code execution inside the Chrome sandbox to escape and attack the Android system_server process. The trigger requires only local access to the vulnerable component, with no additional execution privileges and no user interaction needed for exploitation. A successful attacker gains local escalation of privilege in the Android system server, making the bug especially useful as a privilege-escalation link in exploit chains against Android devices. Any Android device from Google's platform is in scope per CISA's listing (vendor: Google, product: Android, component: Android Runtime); specific affected version ranges are not enumerated in the source data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-04 and Google's related headlines indicate it is being actively exploited in the wild; EPSS currently estimates only a 0.5% probability of exploitation in the next 30 days, and ransomware use is listed as unknown.

Do: Apply Google's Android security updates (September 2025 security bulletin patch level or later) as soon as they are available for your devices, since this flaw is listed in CISA's KEV and reported as exploited in the wild; per KEV required action, federal agencies must follow BOD 22-01 timelines or discontinue use if mitigations are unavailable. Use MDM/EDR tooling to verify device security patch levels, and note that because this is a sandbox-escape-to-system_server bug, it is most dangerous when chained with a browser/renderer exploit, so keeping Chrome/WebView current matters as well.