Google released its June 2026 Android security update on Monday, patching 124 vulnerabilities across the operating system. The most critical is CVE-2025-48595, a high-severity privilege escalation flaw in the Android Framework component with a CVSS score of 8.4 that is already being exploited in limited, targeted attacks.
The vulnerability is caused by an integer overflow that enables code execution and elevated privileges on affected devices without requiring user interaction. It impacts devices running Android 14, 15, 16, and 16 QPR2. Google acknowledged indications of active exploitation but did not disclose details about the threat actors or targets involved.
CISA added CVE-2025-48595 to its Known Exploited Vulnerabilities (KEV) catalog on June 2, requiring federal agencies to remediate by June 5 — an unusually tight three-day deadline. Google released two patch levels: 2026-06-01 and 2026-06-05, with the latter including additional fixes for kernel and third-party chipset components from Imagination Technologies, MediaTek, Qualcomm, and Unisoc. A second zero-day, CVE-2026-21385 affecting Qualcomm graphics drivers, was also confirmed exploited in targeted attacks.
Source
Android Security Bulletin — June 2026 · The Hacker News · Security Affairs
Commentary
The three-day CISA remediation deadline for CVE-2025-48595 signals how seriously the government is taking this one. Privilege escalation without user interaction is a spyware vendor’s dream — and Google’s vague “limited, targeted attacks” language is the same phrasing they use when commercial surveillance tools are involved. If you’re on Android, patch now.
The bigger picture: 124 vulnerabilities in a single monthly patch cycle is a lot, even by Android standards. With two confirmed zero-days in the mix, this is a reminder that the Android ecosystem’s fragmented update pipeline — where carrier and manufacturer delays can leave millions of devices exposed for weeks — remains one of mobile security’s most persistent problems.