Google on Monday released patches for 124 security vulnerabilities impacting its Android operating system for the month of June 2026, including one high-severity flaw in the Framework component that has come under active exploitation.
Tracked as CVE-2025-48595 (CVSS score: 8.4), the security flaw has been described as a case of privilege escalation without requiring any user interaction. The vulnerability impacts devices running Android versions 14, 15, 16, and 16 QPR2 (Quarterly Platform Release 2).
“In multiple locations, there is a possible way to achieve code execution due to an integer overflow,” according to a description of the vulnerability on CVE.org. “This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.”
Google has acknowledged there are indications that CVE-2025-48595 may be under “limited, targeted exploitation.” As is typically the case, the tech giant did not reveal any specifics about who may have been behind the activity, the targets affected, and the scale of such efforts.
That said, similar flaws have been weaponized by commercial spyware vendors to target high-profile individuals as part of extremely targeted attacks.
Elsewhere, a number of vulnerabilities have been patched in the System component, the most severe of which could lead to local escalation of privilege with no additional execution privileges needed.
Google has released two sets of patches – 2026-06-01 and 2026-06-05 security patch levels – with the latter including all fixes from the first set, along with patches for kernel and third-party chipset components from Imagination Technologies, MediaTek, Qualcomm, and Unisoc.
Update
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on June 2, 2026,
added
CVE-2025-48595 to its Known Exploited Vulnerabilities (
KEV
) catalog, requiring Federal Civilian Executive Branch (FCEB) agencies to remediate the flaw by June 5, 2026.
