Google Patches Zero-Days and Fixes 120 Flaws in September Security Update

Fast Facts

1. Google patched two high-severity zero-day vulnerabilities in its September Android security update, which may be under limited targeted exploitation.
2. The update addresses a total of 120 software defects, including critical remote code execution and privilege escalation flaws across system, kernel, and hardware components.
3. Two patch levels (2025-09-01 and 2025-09-05) enable device-specific vulnerability fixes, but third-party manufacturers release subsequent patches on their own schedule.
4. Additionally, 32 Qualcomm-related vulnerabilities, including three critical ones, have been fixed, with source code patches to be released to the Android Open Source Project shortly.

What’s the Problem?

Google recently issued a significant security update for Android devices, addressing 120 vulnerabilities, including two critical zero-day flaws—CVE-2025-38352 in the kernel and CVE-2025-48543 in Android Runtime—that are actively being exploited in targeted attacks. These high-severity vulnerabilities can be exploited without user interaction, potentially allowing malicious actors to escalate their privileges on affected devices. While Google has not reported active exploitation of these zero-days since May, the fact that they are under limited, targeted attack underscores their severity and the urgent need for users to implement the patches. The update includes two patch levels—2025-09-01 and 2025-09-05—covering a broad array of other issues across the system, frameworks, and hardware components, with certain vulnerabilities affecting popular hardware vendors like Qualcomm and MediaTek, some of which are also classified as critical.

This comprehensive security patch release comes amid the highest vulnerability disclosure volume of the year, heavily emphasizing the importance of timely updates for Android users. Third-party manufacturers are responsible for customizing and deploying these patches for their specific devices, which may introduce delays. The patches for all vulnerabilities will soon be available in the Android Open Source Project repository, enabling further scrutiny and mitigation. Google’s warnings and the detailed disclosure of these critical flaws highlight the ongoing threat landscape and reinforce the importance of deploying security updates promptly to protect Android users from potential exploitation by malicious actors.

What’s at Stake?

Google’s September Android security update underscores the escalating cyber risks associated with unpatched vulnerabilities, notably the discovery of two high-severity zero-day flaws (CVE-2025-38352 and CVE-2025-48543) that are actively being exploited in limited targets, allowing attackers to escalate privileges without user interaction. This month’s release, the largest so far in 2023, patches 120 vulnerabilities across core components—covering kernel, Android Runtime, media, and hardware-specific modules like Qualcomm and MediaTek—highlighting the pervasive threat landscape. These critical flaws, especially those enabling remote code execution and affecting proprietary hardware components, expose devices to malware, ransomware, or data breaches, with potential impacts ranging from system compromise to full device takeover. The fact that third-party manufacturers delay their patches further amplifies the risk window, emphasizing the urgent need for timely updates and robust vulnerability management to safeguard device security amid complex, targeted cyberattacks.

Possible Remediation Steps

Prompted by the critical nature of the recent September security update from Google, addressing 120 defects including two Android zero-day vulnerabilities, it’s essential to prioritize swift remediation. Timely action ensures that potential exploits are contained before they can be exploited by malicious actors, safeguarding sensitive data and maintaining system integrity.

Mitigation Strategies

• Immediate Updates
  Ensure all devices are promptly updated with the latest security patches provided by Google.

• Vulnerability Scanning
  Conduct comprehensive scans to identify devices or systems still vulnerable to the zero-day exploits.

• Network Segmentation
  Isolate critical systems from vulnerable devices to prevent potential lateral movement of threats.

• Access Control
  Reinforce user authentication and restrict privilege levels to limit exposure.

• Security Monitoring
  Enhance intrusion detection systems to identify suspicious activities related to the known vulnerabilities.

Remediation Actions

• Patch Deployment
  Rapidly distribute security patches to all Android devices and affected systems.

• Rollback Procedures
  Prepare contingency plans to revert to previous stable firmware if patches cause instability.

• User Education
  Inform users about the importance of applying updates and recognizing phishing attempts linked to exploits.

• Incident Response
  Establish protocols to respond swiftly to any signs of compromise or attempted exploitation.

• Vendor Coordination
  Maintain open communication with Google and device manufacturers to monitor ongoing threat developments and patch quality.

Continue Your Cyber Journey

Stay informed on the latest Threat Intelligence and Cyberattacks.

Explore engineering-led approaches to digital security at IEEE Cybersecurity.

Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.

Cyberattacks-V1