Google Releases Android Bulletin Patching 107 Vulnerabilities

Google released its December 2025 Android Security Bulletin on December 1, disclosing 107 vulnerabilities affecting Android devices running version 13 and later, including two high-severity flaws already under limited, targeted exploitation in the wild. The bulletin provides patches for these issues, which span the Android Framework, system components, kernel, and third-party elements from vendors such as Qualcomm, MediaTek, Unisoc, Arm, and Imagination Technologies. Manufacturers are responsible for delivering the fixes through device-specific security updates, with two patch levels available: 2025-12-01 and 2025-12-05.

The two exploited vulnerabilities, tracked as CVE-2025-48633 and CVE-2025-48572, both reside in the Android Framework and carry high severity ratings. CVE-2025-48633 enables unauthorized disclosure of sensitive information, while CVE-2025-48572 allows attackers to gain elevated privileges on affected devices. Google stated that these flaws may be subject to targeted attacks but did not provide technical details on the exploitation methods. As of the bulletin's release, neither vulnerability had been added to the U.S. Cybersecurity and Infrastructure Security...