Google developers released security updates for Android that fixed 120 vulnerabilities in the operating system. According to the company, two of the issues had already been exploited by attackers in targeted campaigns.
This month’s fixed zero-days have been assigned identifiers CVE-2025-38352 (7.4 on the CVSS scale) — a privilege escalation vulnerability in the Linux kernel component — as well as CVE-2025-48543 — a privilege escalation vulnerability in the Android Runtime component.
Google notes that these vulnerabilities are already being exploited in limited, targeted attacks; however, the company is not disclosing any details about these incidents. It is reported that exploiting the vulnerabilities requires no user interaction.
CVE-2025-38352 is a vulnerability in the Linux kernel that was discovered on July 22, 2025 and fixed in kernel versions 6.12.35-1 and later. The issue is related to a race condition in POSIX CPU timers and triggers failures in task cleanup procedures, destabilizing the kernel, which can lead to crashes, denial of service, and privilege escalation.
CVE-2025-48543, in turn, affects the Android Runtime, where Java/Kotlin applications and system services run. It potentially allows a malicious app to bypass the sandbox and gain access to higher-privileged system capabilities.
In addition to two actively exploited 0-days, the September update fixed four critical bugs.
CVE-2025-48539, a remote code execution (RCE) issue in an Android system component. It allows an attacker within physical or network proximity (for example, within Bluetooth or Wi‑Fi range) to execute arbitrary code on the device without any user interaction or privileges.
CVE-2025-21450, CVE-2025-21483, and CVE-2025-27034 affect Qualcomm’s proprietary components. According to details provided by Qualcomm in its own security bulletin, CVE-2025-21450 pertains to the GPS management system, CVE-2025-21483 concerns issues with network data stacks, and CVE-2025-27034 is linked to a problem in the multimode call processor.
Google has traditionally prepared two patch levels: 2025-09-01 and 2025-09-05, to allow partners to more quickly fix some vulnerabilities common across all Android devices.