Google has launched its month-to-month safety updates for Android with fixes for 46 safety flaws, together with one vulnerability that it mentioned has been exploited within the wild.
The vulnerability in query is CVE-2025-27363 (CVSS rating: 8.1), a high-severity flaw within the System element that would result in native code execution with out requiring any further execution privileges.
“Probably the most extreme of those points is a excessive safety vulnerability within the System element that would result in native code execution with no further execution privileges wanted,” Google mentioned in a Monday advisory. “Person interplay will not be wanted for exploitation.”
It is price noting that CVE-2025-27363 is rooted within the FreeType open-source font rendering library. It was first disclosed by Fb in March 2025 as having been exploited within the wild.
The shortcoming has been described as an out-of-bounds write flaw that would lead to code execution when parsing TrueType GX and variable font recordsdata. The difficulty has been remediated in FreeType variations greater than 2.13.0.
“There are indications that CVE-2025-27363 could also be below restricted, focused exploitation,” Google acknowledged in its safety bulletin. The precise specifics of the assaults are presently unknown.
Google’s Could replace additionally resolves eight different flaws within the Android System and 15 flaws within the Framework module that could possibly be abused to facilitate privilege escalation, data disclosure, and denial-of-service.
“Exploitation for a lot of points on Android is made tougher by enhancements in newer variations of the Android platform,” the corporate mentioned. “We encourage all customers to replace to the newest model of Android the place potential.”
