CVE-2025-48595: Exploited Android Framework Zero-Day (Android 14-16) - June 2026 Update

Published 2026-10-08 · Last updated 2026-10-08

TL;DR: Unlike the Pixel-only modem bug, this one is in core Android, so it affects phones from every manufacturer on Android 14, 15 and 16. An integer overflow in the Framework lets a malicious app gain higher privileges without any tap from you, and Google's June bulletin flags it as exploited. Make sure your phone's security patch level is June 1, 2026 or later.

CVE	CVE-2025-48595
Component	Android Framework (multiple locations)
Type	Integer overflow → code execution → local privilege escalation
User interaction	None needed
Affected	Android 14, 15, 16, 16 QPR2
Fixed in	Security patch level 2026-06-01 (Android Security Bulletin, June 2026)
Exploited?	Yes, CISA KEV 2026-06-02

What the bug is

The Android Framework is the system layer every app talks to. Google’s June 2026 bulletin describes integer overflows in multiple locations that can lead to code execution and local escalation of privilege with no extra permissions and no user interaction. In practice that’s the second stage of an attack: a malicious or compromised app uses it to break out of its sandbox and gain system-level access to your data, messages and accounts.

Am I affected?

Settings → About phone → Android version → Android security update (on Samsung: Settings → About phone → Software information → Android security patch level). If the date is before June 1, 2026, the phone is vulnerable.

Android 13 and older aren’t listed as affected by this CVE, but they no longer receive most security fixes, which is a bigger problem.

How to patch

Pixel: Settings → System → Software updates.
Samsung: Settings → Software update → Download and install.
Others: Settings → System → System update (wording varies). Patches arrive on each manufacturer’s schedule, sometimes weeks or months behind Google.
Also update Google Play system updates (Settings → Security & privacy → System & updates).

If your phone has stopped receiving monthly security updates entirely, this is a good reason to replace it, especially if it’s used for work email or banking.

Reduce your risk

Install apps only from Google Play and keep Play Protect on. Sideloaded apps are the usual delivery route for exploits like this.
Remove apps you no longer use, especially ones from unknown developers.
Businesses: enforce a minimum security patch level in your MDM and block out-of-date devices from company data.

Also see: CVE-2026-58704, the exploited Pixel modem bug (September 2026).

Sources

← Back to Knowledge Base

Want this handled for you?

Desert Forge IT patches, monitors, and backs up servers and networks for Phoenix-area businesses. We track advisories like this one so you don’t have to. Get a free consult and we’ll tell you what you’re exposed to.

Get a free security check → · More security advisories