Google on Monday announced its latest Android update, which includes patches for 124 vulnerabilities, including a zero-day that has been exploited in targeted attacks.
The exploited vulnerability is CVE-2025-48595, which Google describes as a high-severity privilege escalation issue affecting Android’s Framework component.
“There are indications that CVE-2025-48595 may be under limited, targeted exploitation,” Google said in its advisory.
There does not appear to be any information on the attacks exploiting CVE-2025-48595.
However, commercial spyware vendors have become the dominant force behind most zero-day exploits targeting Android devices, developing and selling sophisticated attack chains primarily to government clients. Google’s own researchers are often the ones who discover these exploits.
