Android Framework privilege escalation CVE-2025-48595 used in limited attacks; fixed in June 2026 update
Google fixed CVE-2025-48595, an Android Framework flaw on Android 14 to 16 that may be used in limited, targeted attacks. CISA lists it as exploited. Install Android's June 2026 security update (patch level 2026-06-01 or later) and update apps only from Google Play.
Open Settings, then System, then Software update (or Security update), and install it. Confirm the Android security patch level shows 2026-06-01 or later, ideally 2026-06-05 or later. If your phone no longer gets updates, ask the maker or consider replacing it.
- Androidfixed in Security patch level 2026-06-01 and later
What’s happening
CVE-2025-48595 is an integer overflow in the Android Framework, the core system layer of Android phones and tablets. Google rated it high severity in its June 2026 Android Security Bulletin, published on 1 June 2026. A malicious app already on a device could use it to gain higher system privileges, which could let it run its own code with more access than it should have. Google says there are indications it may be under limited, targeted exploitation, and CISA added it to its list of flaws known to be used in attacks on 2 June 2026. The bulletin does not say who is being targeted or by whom. It affects Android 14, 15, 16 and 16-qpr2. Google says devices with security patch level 2026-06-01 or later are fixed, and level 2026-06-05 includes all earlier fixes. Whether each phone maker has released the update for its models is not covered in the bulletin. The bulletin was last revised on 12 October 2026.
- What
- Flaw
- Affects
- Android phones and tablets (Android 14, 15, 16)
- Affected
- Android 14
Android 15
Android 16
Android 16-qpr2 - Fixed in
- Android security patch level 2026-06-01 or later
Security patch level 2026-06-05 includes all earlier fixes - Since
- 1 June 2026
- Closed
- 12 Oct 2026
Timeline
- Vendor revised
The Android bulletin was last updated on 12 October 2026 (version 1.4), after earlier revisions on 3 June, 25 August and 2 September. The page still describes the exploitation as limited and targeted and does not name victims or attackers.
- CISA added
CISA added CVE-2025-48595 to its list of flaws known to be used in attacks. Help Net Security described it as a local attack needing no user interaction, most likely delivered through a malicious app.
- New fixFixed
Google's June 2026 Android Security Bulletin listed CVE-2025-48595 as a high-severity privilege escalation flaw in the Android Framework, affecting Android 14, 15, 16 and 16-qpr2. It is fixed at security patch level 2026-06-01 or later, and the bulletin says there are indications of limited, targeted exploitation.
- Made public
According to Help Net Security, citing a GrapheneOS update, Google told phone makers about the flaw in a security preview in late September 2025, and GrapheneOS shipped a fix in its 2025092501 release.
Sources
- Android Security Bulletin: June 2026Android Open Source Project · 1 June 2026
- Google fixes actively exploited Android vulnerability (CVE-2025-48595)Help Net Security · 2 June 2026