Google patches Android zero-days under attack
Google's March 2025 Android security update addresses 40+ vulnerabilities including two zero-days exploited in targeted attacks, with remote code execution and privilege escalation flaws.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 21 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2024-43093 and CVE-2024-50302 as exploited in the wild.
Google has released its March 2025 security update for Android OS, addressing multiple critical vulnerabilities that affect devices running patch levels prior to 2025-03-05. The most severe vulnerabilities could allow remote code execution with no additional execution privileges required. These flaws span multiple components including the Android Framework, System, and Kernel layers, with eight vulnerabilities enabling remote code execution through client-side exploitation and eleven enabling privilege escalation.
Google has confirmed limited, targeted exploitation of two vulnerabilities: CVE-2024-43093 in Google Play system updates and CVE-2024-50302 in the Kernel component. Both zero-days are being actively exploited in the wild, elevating the urgency of patching. The update also addresses information disclosure and denial-of-service vulnerabilities across Framework and System components.
The security bulletin includes patches for vulnerabilities in third-party components from MediaTek and Qualcomm, both open and closed-source. Organizations are advised to apply the March 2025 security patch immediately, particularly given the confirmed exploitation of two vulnerabilities. The MS-ISAC has classified the risk level as high for government and business users, with moderate risk for home users.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-android-os-could-allow-for-remote-code-execution_2025-025
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs