Google fixes one actively exploited Android zero-day, 124 flaws

Impact

The actively exploited zero-day (CVE-2025-48595) enables local attackers to execute arbitrary code and escalate privileges on Android 14 and later devices, potentially compromising device security. The presence of additional critical vulnerabilities, including a remote privilege escalation flaw exploitable without user interaction, increases the risk to unpatched devices. Exploitation is currently limited and targeted, but these vulnerabilities could facilitate unauthorized access, privilege escalation, and denial-of-service conditions on affected devices.