Google patches actively exploited Android zero-day in June 2026 update
Google's June 2026 Android security update fixes 124 vulnerabilities, including CVE-2025-48595, a zero-day that attackers are already exploiting. The integer overflow flaw in the Android Framework lets a local attacker gain elevated system access with no user interaction, affecti
Google has released its June 2026 Android security update, fixing 124 vulnerabilities including one actively exploited zero-day. CVE-2025-48595 is an integer overflow bug in the Android Framework that lets a local attacker escalate privileges without user interaction. Google describes it as under limited, targeted exploitation, a pattern often linked to spyware vendors or state-backed actors. The flaw affects Android 14, 15 and 16; 18 of this month's fixes are rated critical. The patch ships in two levels, the second adding Qualcomm and MediaTek chipset driver fixes.