Google has released critical security patches for Android devices to address 57 vulnerabilities across multiple subsystems, including an actively exploited remote code execution flaw tracked as CVE-2025-27363.
The May 2025 security bulletin confirms this high-severity vulnerability in Android’s System component enables local code execution without requiring additional privileges or user interaction.
Devices running Android 13 (2022) and 14 (2023) are particularly vulnerable, with security patch levels prior to 2025-05-05 leaving nearly 40% of active Android devices exposed.
The CVE-2025-27363 vulnerability represents the most immediate threat, with evidence of limited targeted exploitation in the wild.
This remote code execution flaw resides in memory management subsystems handling inter-process communications.
Successful exploitation could allow attackers to deploy malware, exfiltrate sensitive data, or gain persistent access through privilege escalation chains.
Google’s security team identified improper input validation in Binder transactions – Android’s inter-process communication (IPC) mechanism – as the root cause.
The vulnerability allows malformed transactions to overwrite critical kernel structures, bypassing Android’s SELinux protections.
Patches have been pushed to Android Open Source Project (AOSP) repositories for versions 13 and 14, with OEM partners receiving advanced notifications for rapid deployment.
This marks the fourth actively exploited Android vulnerability in 2025, continuing a concerning trend of mobile-focused cyberattacks.
Researchers at Kaspersky’s Global Research and Analysis Team (GReAT) have observed this exploit being paired with privilege escalation flaws like CVE-2025-26420 to create rootkits targeting financial applications.
The May update resolves 23 high-severity flaws across Android’s core components:
Twelve elevation-of-privilege (EoP) vulnerabilities in the application framework could let malicious apps bypass signature checks or access protected intents.
Notable fixes include CVE-2025-26422 in JobScheduler (patched in Android 15) and CVE-2025-26440 affecting Foreground Service management in Android 141.
Collaboration with silicon partners addressed critical issues in:
The kernel subsystem received backported fixes up to Linux 5.4.284 for devices launched with Android 121. These updates prevent DMA attacks and memory corruption in wireless drivers.
Project Mainline updates patch vulnerabilities in modular system components:
These updates roll out automatically through Google Play Services, requiring no OEM intervention.
Google emphasizes multi-layered protections:
Enterprise administrators should prioritize:
Consumer protections include:
Google continues working with CERT/CC and MITRE to improve CVE tracking for mobile vulnerabilities.
The company’s 2025 Android Security Report shows a 17% reduction in critical vulnerabilities year-over-year, attributing progress to improved compiler sanitizers and hardware-enforced memory safety.
Setting Up SOC Team? – Download Free Ultimate SIEM Pricing Guide (PDF) For Your SOC Team -> Free Download
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…