Google has launched safety updates to handle a number of safety flaws in Android, together with fixes for 2 Qualcomm bugs that had been flagged as actively exploited within the wild.
The vulnerabilities embody CVE-2025-21479 (CVSS rating: 8.6) and CVE-2025-27038 (CVSS rating: 7.5), each of which had been disclosed alongside CVE-2025-21480 (CVSS rating: 8.6), by the chipmaker again in June 2025.
CVE-2025-21479 pertains to an incorrect authorization vulnerability within the Graphics element that would result in reminiscence corruption as a result of unauthorized command execution in GPU microcode.
CVE-2025-27038, alternatively, use-after-free vulnerability within the Graphics element that would lead to reminiscence corruption whereas rendering graphics utilizing Adreno GPU drivers in Chrome.
There are nonetheless no particulars on how these shortcomings have been weaponized in real-world assaults, however Qualcomm famous on the time that “there are indications from Google Menace Evaluation Group that CVE-2025-21479, CVE-2025-21480, CVE-2025-27038 could also be underneath restricted, focused exploitation.”
Provided that related flaws in Qualcomm chipsets have been exploited by business spyware and adware distributors like Variston and Cy4Gate prior to now, it is suspected that the aforementioned shortcomings can also have been abused in an identical context.
The three vulnerabilities have since been added to the U.S. Cybersecurity and Infrastructure Safety Company’s (CISA) Recognized Exploited Vulnerabilities (KEV) catalog, requiring federal companies to use the updates by June 24, 2025.
Google’s August 2025 patch additionally resolves two high-severity privilege escalation flaws in Android Framework (CVE-2025-22441 and CVE-2025-48533) and a important bug within the System element (CVE-2025-48530) that would lead to distant code execution when mixed with different flaws with out requiring any further privileges or consumer interplay.
The tech large has made accessible two patch ranges, 2025-08-01 and 2025-08-05, with the latter additionally incorporating fixes for closed-source and third-party parts from Arm and Qualcomm. Android gadget customers are suggested to use the updates as and after they grow to be accessible to remain protected in opposition to potential threats.
