Google releases June 2026 Android update fixing 124 flaws

Google has released its June 2026 Android security updates, addressing 124 vulnerabilities across the operating system. Among the patched flaws is a high-severity issue in the Android Framework component that is already being exploited in targeted attacks.

The exploited vulnerability, tracked as CVE-2025-48595, is described as a privilege escalation flaw that does not require any user interaction for successful exploitation. It affects devices running Android versions 14, 15, 16, and 16 QPR2. Google stated there are indications the flaw may be under "limited, targeted exploitation," but did not provide specifics about the attacks, their perpetrators, or the targets. Historically, similar vulnerabilities have been weaponized by commercial spyware vendors and other actors to compromise devices in highly targeted campaigns.

The Framework flaw is an integer overflow vulnerability that could allow local attackers to execute code and escalate privileges on a compromised device. Google's advisory noted the most severe issue addressed this month is a critical security vulnerability in the Framework component that could lead to remote escalation of privilege.