Google on Monday released monthly security updates for the Android operating system, including two vulnerabilities that it said have been exploited in the wild.
The patch addresses a total of 107 security flaws spanning different components, including Framework, System, Kernel, as well as those from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unison.
The two high-severity shortcomings that have been exploited are listed below –
- CVE-2025-48633 – An information disclosure vulnerability in Framework
- CVE-2025-48572 – An elevation of privilege vulnerability in Framework
As is customary, Google has not released any additional details about the nature of the attacks, exploiting them, if they have been chained together or used separately, and the scale of such efforts. It’s not known who is behind the attacks.
However, the tech giant acknowledged in its advisory that there are indications they “may be under limited, targeted exploitation.”
Also fixed by Google as part of the December 2025 updates is a critical vulnerability in the Framework component (CVE-2025-48631) that could result in remote denial-of-service (DoS) with no additional execution privileges needed.
The security bulletin for December includes two patch levels, namely, 2025-12-01 and 2025-12-05, giving device manufacturers flexibility to address a portion of vulnerabilities that are similar across all Android devices more quickly. Users are recommended to update their devices to the latest patch level as soon as the patches are released.
The development comes three months after the company shipped fixes to remediate two actively exploited flaws in the Linux Kernel (CVE-2025-38352, CVSS score: 7.4) and Android Runtime (CVE-2025-48543, CVSS score: 7.4) that could lead to local privilege escalation.
