Google Patches 107 Android Vulnerabilities, Two Zero-Days

Google released its December 2025 Android Security Bulletin on December 1, detailing patches for 107 vulnerabilities affecting Android devices running versions 13 through 16. The update addresses critical flaws in the operating system's core components, including two high-severity zero-day vulnerabilities that security researchers believe are under limited, targeted exploitation, potentially by state-sponsored actors or spyware operations.

The bulletin highlights CVE-2025-48633 and CVE-2025-48572, both in the Android Framework, a set of essential software libraries and APIs used by app developers. CVE-2025-48633 enables unauthorized access to sensitive information, while CVE-2025-48572 allows attackers to elevate privileges on affected devices. Google stated that these issues may be actively exploited in the wild, though it withheld specific technical details to prevent further abuse. As of the release, neither vulnerability had been added to the U.S. Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities catalog, but officials expect inclusion soon, along with mandates for federal systems to patch within weeks.

Among the most pressing fixes is...