Google’s December 2025 Android Security Bulletin includes fixes for 107 vulnerabilities, including two zero-days—CVE-2025-48633 and CVE-2025-48572—that are already being exploited in targeted attacks. The flaws affect Android versions 13 through 16 and impact the Framework component, enabling information disclosure and potential privilege escalation. While Google has not named a responsible threat group, its wording suggests the involvement of commercial spyware operators. Devices updated to the 2025-12-05 security patch level contain the full set of protections.

Android’s ecosystem remains a significant target for both nation-state and commercial surveillance actors, largely due to its global reach and fragmented update deployment. Zero-day exploitation—particularly against the Framework layer—offers highly valuable access for attackers seeking persistent surveillance capabilities.

Google publishes monthly security bulletins to coordinate patch distribution across vendors. December’s bulletin stands out due to the presence of two actively exploited vulnerabilities with minimal public detail, a pattern typically associated with targeted spyware campaigns.

Google confirmed that two Framework vulnerabilities were exploited in real-world attacks prior to patch availability.
The two zero-days are:

Both vulnerabilities affect modern Android versions (13–16), indicating widespread exposure.

The security bulletin offers only a brief note: “There are indications that the following may be under limited, targeted exploitation.” Google has not disclosed the attack vector, scope, or attribution.

The December 2025 update contains:

Key areas patched include:

The most severe issue fixed this month—separate from the exploited zero-days—is a critical Framework vulnerability leading to remote denial of service without privileges.

Google Play system updates, Android Automotive OS, and Wear OS received no security patches this cycle.

Because the exploited vulnerabilities provide data leakage and potential privilege escalation, attackers may gain:

The limited and targeted exploitation strongly suggests high-value victims—such as journalists, political figures, corporate executives, or activists—rather than mass attacks.

Zero-day exploitation of Android Framework components remains one of the clearest markers of sophisticated spyware vendors. These actors frequently rely on privilege escalation and information disclosure flaws to bypass sandboxing and maintain persistent device surveillance.

The presence of two exploited zero-days in a single bulletin underscores:

These characteristics—limited exploitation, Framework-level impact, and sparse disclosure—strongly align with the operational profile of commercial spyware providers. While Google does not name the responsible actors, similar cases over the past two years were attributed to vendors like NSO Group, Intellexa, and unnamed surveillance contractors.

Organizations managing high-risk personnel should treat these flaws as prioritized threats and validate that devices receive the 2025-12-05 patch level or later.