Reported by 6 outlets
Android Zero-Day (CVE-2025-48595) Actively Exploited — Google's June 2026 Bulletin Patches 30+ Framework CVEs
Why this score
- Breadth
- 2.00 / 2.0 · 6 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.22 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
CVE-2025-48595 is an integer overflow in the Android Framework that permits code execution and local escalation of privilege with no additional execution privileges and no user interaction, affecting Android 14, 15, 16, and 16-QPR2. Google fixed it as bug A-430889718 in the June 2026 Android Security Bulletin, published June 1, 2026, rated High severity with a secondary CVSS 3.1 score of 8.4, and the bulletin itself carries the note that the flaw may be under limited, targeted exploitation. CISA added it to the KEV catalog on June 2, 2026. The same bulletin ships 64 CVEs at the 2026-06-01 patch level, and its most severe item is a critical Framework remote escalation of privilege that also needs no user interaction.
The exploitation model is what makes this story and not the other thirty. A local flaw needing zero interaction and zero privileges is a privilege stage, not a delivery stage, so real use is almost certainly chained behind a sandbox escape or a malicious app already on the device, which means there is no lure for a victim to avoid and no phishing control that helps. The cadence is the part an event skim misses: Google flagged CVE-2025-48572 and CVE-2025-48633 as under targeted exploitation in the December 1, 2025 bulletin and CISA KEV-listed both the next day, and the June cycle repeated the pattern exactly, bulletin June 1, KEV June 2. Two cycles in, an actively exploited Android Framework flag from Google has become a federal remediation mandate within 24 hours, so using KEV as a patch trigger for Android is already a losing posture. Exposure is the widest of any class of device in the fleet, hundreds of millions of handsets across the Android 14 through 16-QPR2 span.
Patch level is the only control that matters here: verify managed devices report the 2026-06-05 security patch level or later, which covers everything in the 2026-06-01 patch level, and treat any Android 14 BYOD device below that string as unremediated. For the separate ADB daemon authentication bypass CVE-2026-0073, where EVP_PKEY_cmp() type confusion returns -1, truthy in C, when an EC or Ed25519 certificate is checked against a stored RSA key and grants an unauthorized shell, the preconditions are Developer Options with wireless debugging enabled plus a prior USB pairing, so disable wireless debugging on managed devices and revoke stored ADB pairing authorizations now. Treat the reported June-bulletin fix for CVE-2026-0073 as unverified: the published June 2026 bulletin does not list that CVE ID and KEV has no entry for it. The hunt is behavioral, not signature-based: ADB shell sessions on devices where no developer works, and wireless debugging listeners that nobody enabled on purpose.
Two developments would change the assessment. CVE-2025-48595 moving from limited, targeted exploitation to mass exploitation, or surfacing in a named-actor spyware chain, would turn patch compliance into an emergency for fleets dominated by Android 14 hardware that updates slowly. And CVE-2026-0073 gaining a confirmed bulletin entry or KEV listing would validate the fix while several published PoCs make public exploitation a copy-paste exercise.
Timeline
-
original reporting
Android Zero-Day (CVE-2025-48595) Actively Exploited — Google's June 2026 Bulletin Patches 30+ Framework CVEs
cyberpress.org · 134d ago · June 2nd, 2026
Google confirmed active exploitation of CVE-2025-48595, a high-severity integer overflow in the Android Framework component, in its June 1 Android Security Bulletin. The flaw enables local privilege escalation to SYSTEM level with zero user interaction — no phishing, no malicious link, no app installation required. Google's bulletin language mirrors the December 2025 disclosure pattern for CVE-2025-48633 and CVE-2025-48572, which were added to CISA KEV within 24 hours.
Scope: Android 14, 15, 16, and 16-QPR2 — hundreds of millions of devices. The June bulletin patches 30+ Framework CVEs, 35+ System CVEs, plus Kernel and vendor components. Devices running the 2026-06-05 security patch level are protected. Source code patches will hit AOSP within 48 hours.
ADB bypass (CVE-2026-0073, cross-reference gap): Multiple PoCs published for a separate critical authentication bypass in the ADB daemon's TLS certificate verification —
EVP_PKEY_cmp()type confusion returns-1(truthy in C) when an EC/Ed25519 certificate is presented against a stored RSA key, granting unauthorized shell access. Requires Developer Options + wireless debugging enabled with prior USB pairing. Patched in the same June bulletin. -
update from source.android.com
Android Security Bulletin, December 2025
source.android.com · 317d ago · December 1st, 2025
The December 2025 bulletin, published December 1, 2025, explicitly flags two Android Framework issues, CVE-2025-48633 and CVE-2025-48572, as possibly under limited, targeted exploitation. This predates the June 2026 coverage in this story by six months and shows Google had already disclosed actively exploited Framework flaws in the immediately preceding bulletin cycle.
-
mentioned by cisa.gov
CISA Known Exploited Vulnerabilities Catalog: Android Framework entries
cisa.gov · 316d ago · December 2nd, 2025
-
update from source.android.com
Android Security Bulletin, June 2026
source.android.com · 135d ago · June 1st, 2026
The vendor advisory, published June 1, 2026 and last updated September 2, 2026, lists CVE-2025-48595 (bug A-430889718, elevation of privilege, High severity, Android 14, 15, 16 and 16-QPR2) and carries the note that there are indications it may be under limited, targeted exploitation. The bulletin's most severe issue is a critical Framework vulnerability enabling remote escalation of privilege with no user interaction. Sixty-four CVEs apply to the 2026-06-01 security patch level.
-
update from nvd.nist.gov
NVD record for CVE-2025-48595
nvd.nist.gov · 134d ago · June 1st, 2026
The NVD record, assigned by security@android.com and published June 1, 2026, describes the flaw as an integer overflow in multiple locations permitting code execution, leading to local escalation of privilege with no additional execution privileges and no user interaction needed. A secondary CVSS 3.1 score of 8.4 High accompanies it (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
-
update from beyondmachines.net
Google Patches 26 Critical Vulnerabilities in September 2026 Android Security Update Google's September 2026 Android Security Bulletin patch
beyondmachines.net · 31d ago · September 12th, 2026
Google Patches 26 Critical Vulnerabilities in September 2026 Android Security Update Google's September 2026 Android Security Bulletin patch
via Mastodon https://beyondmachines.net/event_details/google-patches-26-critical-vulnerabilities-in-september-2026-android-security-update-u-b-n-j-p/gD2P6Ple2L
-
update from cybertop.ai
CYBERTOP's AI detected CVE-2025-48633: Android Framework info disclosure. Exploited in the wild. Defensive takeaway: update to latest Androi
cybertop.ai · 28d ago · September 15th, 2026
CYBERTOP's AI detected CVE-2025-48633: Android Framework info disclosure. Exploited in the wild.
-
mentioned by cybertop.ai
CYBERTOP AI agents identify CVE-2025-48572 as an Android Framework privilege escalation vulnerability actively exploited. Immediate defensiv
cybertop.ai · 28d ago · September 15th, 2026