Android June 2026 Bulletin: 124 Fixes, One Framework Bug Already Being Exploited
CVE-2025-48595 is a no-interaction privilege escalation in the Android Framework. Google says it's seen in the wild.
Key points
- Google's June 2026 Android bulletin patches 124 vulnerabilities across the OS.
- CVE-2025-48595, a high-severity Framework privilege escalation with a CVSS score of 8.4, is confirmed actively exploited.
- No user interaction is required for the attack to succeed.
- Google describes exploitation as "limited and targeted" but has named no victims and provided no indicators.
- Devices below patch level
2026-06-01are exposed to a known-exploited bug right now.
What is CVE-2025-48595?
It's a privilege escalation flaw sitting in Android's Framework component, the layer that mediates between apps and the OS. CVSS 8.4, no user interaction required, no extra execution privileges needed. An attacker with an existing foothold can move to a higher-privileged context without the victim doing anything at all.
How serious is "limited and targeted" exploitation?
That phrase is Google's standard language when it has credible evidence of in-the-wild abuse but isn't ready to name victims or attribute the activity. No indicators have been published. Framework bugs carrying that label have previously turned up in commercial spyware chains, though Google hasn't made that claim here, and the distinction matters for how you triage.
Google did not credit an external researcher in the public bulletin. That often, though not always, points to an internal discovery via Threat Analysis Group or Project Zero. If a technical writeup appears, expect it weeks after broad OEM rollout.
What else is in the bulletin?
The 124 fixes split across two patch levels. Devices reporting 2026-06-01 include the Framework and System fixes, CVE-2025-48595 among them. The 2026-06-05 level adds vendor-specific patches for Arm, MediaTek, Qualcomm, and Imagination Technologies components. Pixel devices get both levels in a single OTA. Everyone else waits on their OEM, which is the perennial weak point in Android's patch ecosystem.
Beyond the exploited bug, the Framework and System buckets contain several remote code execution entries rated high severity, not just privilege escalation. Qualcomm closed-source components account for a sizeable share of the vendor-side CVEs, consistent with recent months.
We covered a related Android risk on 2 June 2026, when a misconfigured dev flag exposed Microsoft account tokens across billions of Android installs. Both cases show how much damage can flow from a single architectural weak point in the Android stack.
Should you patch immediately?
Yes, particularly if you manage a fleet. Push 2026-06-05 as soon as your OEM publishes it. Verify the applied level via ro.build.version.security_patch rather than relying on the carrier UI, which can lag behind the actual build. For BYOD environments, any device below 2026-06-01 should be treated as exposed to a known-exploited vulnerability until you can confirm otherwise.
The full advisory and per-CVE severity table are on the Android Security Bulletins page. Pixel-specific fixes, which historically include additional Pixel-only CVEs, appear in the separate Pixel bulletin.
Attribution can wait. Patching can't.
