Google and Samsung roll out September 2025 patches with zero-days

Google and Samsung this week issued September 2025 security updates for Android devices that patch multiple high‑severity flaws, including two zero‑day vulnerabilities Google said have been actively exploited in limited, targeted attacks. The company released two patch levels, 20250901 and 20250905, and urged users and device makers to install the updates immediately; Samsung published its own bulletin and is beginning a staged rollout of the combined fixes to Galaxy phones and tablets.

Google warned that two elevation‑of‑privilege flaws, tracked as CVE202538352 in the kernel and CVE202548543 in the Android Runtime, are "under limited, targeted exploitation," according to its security bulletin. The kernel defect is a race condition in POSIX CPU timers that can destabilize the kernel and enable privilege escalation, while the Android Runtime flaw could let a malicious app bypass sandboxing and access higher level system capabilities. Google also highlighted a critical system remote‑code‑execution flaw, CVE202548539, that could be exploited by an attacker within Bluetooth or Wi‑Fi range without user interaction.

Counts of affected vulnerabilities vary across vendor reports....