Friday, June 13, 2025
HomeSecurity NewsGoogle Released Security Update for Android and Fixed 16 Critical Vulnerabilities

Google Released Security Update for Android and Fixed 16 Critical Vulnerabilities

Published on

SIEM as a Service

Follow Us on Google News

Google Released a security update for Android Devices and fixed 16 critical vulnerabilities that affected the recent Android versions.

All the vulnerabilities fixed under the severity of  “critical” and “High” that allows an attacker to execute arbitrary code on the vulnerable Android Devices.

Most of the critical vulnerability fixed under Media Framework that enables to escalate the privilege to multiple android version.

- Advertisement - Google News

Totally 37 flaws were patched, with 26 rated as high severity.The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device.

Also Read: Mobile Security Testing to Protect Your Applications From Cyber Threats

Security Update for Android Media framework

The most severe vulnerability in this section could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of a privileged process.

CVEReferencesTypeSeverityUpdated AOSP versions
CVE-2017-13248A-70349612RCECritical6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13249A-70399408RCECritical6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13250A-71375536RCECritical6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13251A-69269702EoPCritical6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13252A-70526702EoPHigh8.0, 8.1
CVE-2017-13253A-71389378EoPHigh8.0, 8.1

System

The most severe vulnerability in this section could enable a proximate attacker to execute arbitrary code within the context of a privileged process.

CVEReferencesTypeSeverityUpdated AOSP versions
CVE-2017-13255A-68776054RCECritical5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13256A-68817966RCECritical5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13272A-67110137RCECritical7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13266A-69478941RCECritical5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13257A-67110692IDHigh5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13258A-67863755IDHigh5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13259A-68161546IDHigh5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13260A-69177251IDHigh5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13261A-69177292IDHigh5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1
CVE-2017-13262A-69271284IDHigh5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1

Apart from this, Google released a security fix for Android Kernel components, NVIDIA and Qualcomm components used in Android handsets.

Along with this Android security patches, Samsung Mobile provides 5 Samsung Vulnerabilities and Exposures (SVE) for  USB gadget driver,NFC activated by magnet, Clipboard content using Edge panel.

Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible. Google said.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Cybercriminals Exploiting Expired Discord Invite Links to Deploy Multi-Stage Malware

Recent investigations by Check Point Research have uncovered a sophisticated malware campaign that leverages...

Threat Actors Exploit DeepSeek-R1 Popularity to Target Windows Device Users

A new, highly sophisticated cyberattack campaign is targeting users seeking to download the popular...

OpenPGP.js Vulnerability Allows Attackers to Bypass Message Signature Verification

A critical vulnerability in OpenPGP.js, a widely used JavaScript library for encrypted messaging and...

Windows Defender Bypass Using PowerShell and Registry Edits in CyberEYE RAT

A newly discovered remote access trojan (RAT) named CyberEye is making waves in the cybersecurity community...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Don’t Click “Unsubscribe” links blindly It May Leads to Loss of Credentials

Imagine your inbox is overflowing with promotional emails—some from familiar companies, others less so....

ConnectWise to Update Code Signing Certificates for ScreenConnect, Automate, and RMM

ConnectWise, a leading provider of remote management and cyber protection tools for managed service...

ESET Details on How to Manage Your Digital Footprint

ESET, a leading cybersecurity firm, has shed light on the intricate nature of digital...