Google Releases December 2025 Android Security Patch Fixing 107 Vulnerabilities, Including Two Exploited Zero-Days

Forum topic · ✨步子哥 · 2025-12-04

Summary

Google has released its December 2025 Android security bulletin, addressing 107 vulnerabilities across Android 13, 14, 15, and 16. The update fixes 7 critical flaws and includes patches for two zero-day vulnerabilities confirmed to be under limited, targeted exploitation in the wild: CVE-2025-48633, an information disclosure flaw in the Android Framework, and CVE-2025-48572, a privilege escalation vulnerability with a CVSS score of 7.4 that could allow local apps to execute arbitrary code. The fixes are distributed across the Framework (35), System (25), Kernel (20), and third-party components (27). CISA has added both zero-days to its Known Exploited Vulnerabilities catalog and requires federal agencies to apply fixes by December 23, 2025. Users are urged to update to security patch level 2025-12-05 or later, install apps only from official stores, review sensitive permissions, and use updated anti-malware software. A remote denial-of-service issue (CVE-2025-48631) requiring no additional execution privileges is also addressed.

Overview

Google has published its December 2025 Android Security Bulletin, fixing 107 vulnerabilities affecting Android 13, 14, 15, and 16. All users should update to security patch level 2025-12-05 or higher.

Key Statistics

107 total vulnerabilities fixed
7 critical vulnerabilities
2 zero-day vulnerabilities actively exploited in the wild
4 affected Android versions

Distribution of Fixes

| Component | Fixes | |---|---| | Framework | 35 | | System | 25 | | Kernel | 20 | | Third-party components | 27 |

Zero-Day Details

Google confirmed both flaws were under limited, targeted exploitation. CISA has added them to its Known Exploited Vulnerabilities catalog.

CVE-2025-48633 — Information Disclosure

High-severity flaw in an Android Framework component
May lead to disclosure of sensitive information

CVE-2025-48572 — Privilege Escalation

CVSS score: 7.4 / 10
Could allow a local application to execute arbitrary code

> Warning: CISA requires federal agencies to apply fixes by December 23, 2025.

Affected Versions

Android 13
Android 14
Android 15
Android 16

Potential Risks

Privilege escalation: Attackers may gain elevated device privileges and perform unauthorized actions
Information disclosure: Sensitive data, including personal information and credentials, may be exposed
Denial of service: CVE-2025-48631 can be exploited for a remote DoS attack without requiring additional execution privileges

Security Recommendations

1. Update immediately: Install the latest Android security update (2025-12-05 or later) 2. App sources: Only install apps from official app stores; avoid apps promoted via SMS, email, or messaging links 3. Permission review: Scrutinize permission requests, especially accessibility, SMS, and camera permissions 4. Security software: Use up-to-date anti-malware protection

References

Official bulletin: Android Security Bulletin, December 2025
Release date: December 1, 2025