Google has released its September 2025 Android security update, addressing 84 vulnerabilities, including two actively exploited zero-day flaws that posed significant security risks to Android devices. The update builds upon Google’s 2024 Play Protect enhancements, which significantly improved Android’s built-in security infrastructure. The release focuses primarily on patching critical security issues rather than implementing new system restrictions.
The two zero-day vulnerabilities that were being actively exploited include an elevation of privilege flaw in the Android kernel (CVE-2025-38352) and another in the Android Runtime component (CVE-2025-48543). The kernel vulnerability could enable attackers to escalate privileges and potentially cause denial of service conditions on affected devices. The security risk has become increasingly concerning, particularly following similar privilege escalation issues discovered in Android rooting frameworks earlier this year.
The Android Runtime vulnerability presented a particularly significant risk, as it could allow malicious applications to bypass Android’s sandbox restrictions and gain access to elevated system capabilities. The security patch addresses this flaw, complementing Google’s broader efforts to enhance Android’s authentication security, including recent improvements to biometric authentication systems.
The September update continues Android’s regular security maintenance cycle, which typically delivers patches for newly discovered vulnerabilities on a monthly basis. Regular updates have proven crucial in addressing emerging threats, as demonstrated by the discovery of over 2,400 mobile authentication malware variants targeting Android devices in recent months. The security improvements maintain the platform’s existing functionality while strengthening protections against emerging threats.
Android device owners are advised to install the September 2025 security update when it becomes available for their devices. The update is being rolled out gradually across different device manufacturers and models, following the implementation pattern established by Google’s new developer verification requirements for enhanced platform security.
Sources: Tom’s Guide, BleepingComputer
