Android June update fixes framework flaw under targeted exploitation

Google's June 2026 Android security bulletin, published June 1, fixes an Android Framework vulnerability that the company says "may be under limited, targeted exploitation." The Canadian Centre for Cyber Security issued advisory AV26-538 the next day, urging users and administrators to apply the update.

The flaw, CVE-2025-48595, is an integer overflow in several places in the Framework that can lead to code execution and local escalation of privilege without any additional privileges or user interaction, according to its NVD entry. Google's CVSS score is 8.4. The wording "limited, targeted" usually points to use against a small number of people, as is common with commercial spyware, but Google has not said who found the flaw or who is exploiting it.

Details

CISA added CVE-2025-48595 to its Known Exploited Vulnerabilities catalog on June 2 with a June 5 deadline for federal agencies, an unusually short window. CyberInsider reported that the bulletin ships two patch levels, 2026-06-01 and 2026-06-05, and that affected versions run from Android 14 through 16 QPR2.

It is the second Android bulletin this year to flag active exploitation. In March, Google fixed CVE-2026-21385, a flaw in a Qualcomm graphics component that its Threat Analysis Group had found being used in targeted attacks.

What to do

• On your phone, open Settings, then Security and privacy (or System), and check for an update. Look for a security patch level of 2026-06-01 or later.
• Pixel devices receive the patch directly. Samsung and other manufacturers roll out their builds on their own schedules, so check again over the following weeks.
• Organizations managing Android fleets should set a minimum patch level in their mobile device management policy.