Android Zero-Day CVE-2025-48595 Under Active Exploitation: How Fragmentation Turns the June Patch Into a Weeks-Long Problem for Corporate Devices

Google published the June 2026 Android Security Bulletin on 1 June, patching 124 vulnerabilities, 18 of them rated Critical. Of all of them, one stands out: CVE-2025-48595 (CVSS 8.4), a zero-day in the Android Framework component that Google confirmed is being actively exploited in targeted attacks. CISA added it to the KEV catalogue on 2 June with a federal remediation deadline of 5 June — the day after tomorrow. The patch exists, but Android’s ecosystem fragmentation means most Spanish corporate devices — Samsung, Xiaomi, Realme, HONOR, Motorola — will take weeks or months to receive it. For IT managers with BYOD environments or corporate Android devices, the question is not whether a patch exists: it is whether it will arrive before the attacker does.

‍

What do we know about CVE-2025-48595 and the confirmed active exploitation?

Facts documented by Google (Android Security Bulletin June 2026), CISA, BleepingComputer, The Hacker News, Security Affairs, CyberPress and Threat-Modeling.com:

• Vulnerability: integer overflow (CWE-190: Integer Overflow or Wraparound) in the Android Framework component, the central layer of APIs and system services that all Android applications use to interact with the device. When triggered, the integer overflow enables local privilege escalation, giving the attacker access to higher-privilege system resources without the user’s awareness.
• CVSS 8.4 (High): no additional authentication required, no user interaction needed. The attacker can escalate privileges with local access or via an already-installed malicious application.
• Affected versions: Android 14, Android 15, Android 16 and Android 16 QPR2 — hundreds of millions of active devices worldwide.
• Active exploitation confirmed: Google states explicitly in the bulletin: “there are indications that CVE-2025-48595 may be under limited, targeted exploitation.” This language — identical to that used for previous Android zero-days such as CVE-2025-48633 and CVE-2025-48572 in the December 2025 bulletin — confirms real-world attacks without disclosing full technical details to limit exploit reuse.
• Exploitation pattern: the “limited and targeted” nature of exploitation is consistent with use by sophisticated actors targeting high-profile individuals: corporate executives, journalists, dissidents, government officials or those with access to high-value systems. This is not a mass consumer campaign — it is directed espionage.
• CISA KEV: added 2 June 2026. Federal agency remediation deadline: 5 June 2026.
• Patch available: included in Android patch levels 2026-06-01 and 2026-06-05. Google released updates to OEM manufacturers (Samsung, Xiaomi, etc.) on the bulletin date. Each manufacturer is responsible for distributing the update to their devices — timing varies significantly by manufacturer and carrier.

‍

Why corporate Android devices are the target of directed attacks

CVE-2025-48595 is not a vulnerability cybercriminals use to attack consumers at random. The directed exploitation confirmed by Google points to a very specific victim profile. Four factors explain why corporate Android devices are the highest-value target:

1. A corporate Android device is a gateway to the entire company infrastructure. The CEO’s, CFO’s or IT manager’s smartphone has access to corporate email (Exchange, Microsoft 365, Google Workspace), the corporate VPN, internal applications, document repositories, and in many cases two-factor authentication systems. Compromising that device means compromising access to all those resources.
2. BYOD environments are especially vulnerable. In many Spanish companies, the employee’s personal device — with the same corporate email account, the same access to SharePoint or Teams, and the same VPN credentials — is their personal Android smartphone. Personal device update cycles are far more irregular than those of MDM-managed devices.
3. Android 14 and 15 dominate the corporate device fleet in Spain. Most corporate smartphones in use are between 1 and 3 years old, meaning they run Android 14 or 15 — exactly the affected versions.
4. Local privilege escalation is especially dangerous on devices with corporate access. CVE-2025-48595’s attack pattern requires the attacker to have already achieved code execution on the device — for example via a malicious application, a browser exploit, or physical device access. Once inside, CVE-2025-48595 escalates privileges to system level, enabling extraction of stored credentials, corporate application data, session cookies and authentication tokens.

‍

How the attack works: from integer overflow to privilege escalation

1. Initial device access. The attacker needs a first code-execution vector on the device — typically a malicious application distributed outside Google Play, a browser exploit, or in the most sophisticated attacks a chain of exploits triggered by opening a malicious document or link.
2. Integer overflow activation. The malicious code sends specially crafted values to the vulnerable Android Framework component. The integer overflow at multiple Framework locations produces unexpected memory behaviour: the system assumes a value fits in a data type that cannot contain it, creating race conditions or memory corruption controllable by the attacker.
3. Privilege escalation. The memory corruption allows the malicious code to execute with system privileges (UID 0 or equivalent), bypassing Android’s sandboxing model that keeps applications isolated from each other and the OS.
4. Post-exploitation. With system privileges, the attacker has access to everything on the device: credentials stored in the system password manager, session cookies from browsers and corporate applications, device encryption keys, MDM application data, activity logs and any data synchronised with the corporate profile.

‍

The fragmentation problem: why your Android device may take weeks to receive the patch

The CVE-2025-48595 patch exists and is available. The problem is getting it to employees’ devices. Android’s patch distribution chain has three links, each adding time:

1. Google → OEM manufacturers (1–4 weeks). Google releases the patch to Samsung, Xiaomi, Realme, HONOR, Motorola and other manufacturers on the bulletin date. Each manufacturer must integrate the security patch into their own software layer (One UI for Samsung, MIUI for Xiaomi, etc.), requiring compatibility testing, internal validation and OTA update generation.
2. OEM manufacturers → Telecoms operators (0–3 additional weeks). In many markets, including Spain, operators (Movistar, Vodafone, Orange, MasMóvil) receive the update from the manufacturer and run their own network compatibility tests before distributing it to users, adding between 0 and 3 additional weeks.
3. Operators → User devices (user-dependent). Once available, the update must be installed by the user. In BYOD environments without MDM, the device may have update notifications disabled, automatic updates turned off, or the user may postpone indefinitely.

The result: between the zero-day’s disclosure and patch application on a typical Spanish Samsung or Xiaomi employee device, 4 to 10 weeks may pass. Google Pixel devices are the exception — they receive the patch on the bulletin date. But Pixel represents under 5% of the Spanish market.

‍

Key lessons and checklist for IT managers and CISOs with BYOD environments

Immediate action — Google Pixel devices in the corporate environment:

• Verify all Pixels have received patch level 2026-06-01 or higher: Settings → About phone → Android security patch level. If not, apply the update manually.

Urgent action — Samsung, Xiaomi, HONOR, Realme, Motorola devices:

• Verify the security patch level installed on each device. Any level prior to 2026-06-01 does not include the CVE-2025-48595 fix. Apply the update via Settings → Software update → Download and install as soon as available for the specific model.
• If the update is not yet available for a specific model, escalate to the manufacturer and consider additional mitigation measures.

For environments with MDM/EMM (Microsoft Intune, VMware Workspace ONE, etc.):

• Create or update compliance policies to require a minimum Android security patch level of 2026-06-01 as a condition for access to corporate resources.
• Configure the MDM to detect non-compliant devices and apply remediation actions (block corporate email access, notify the user, escalate to the security team).

For BYOD environments without MDM:

• Communicate to all employees with corporate access from Android devices the urgency of updating and how to do so (Settings → Software update).
• Evaluate the urgent implementation of an MDM or MAM (Mobile Application Management) solution to control and verify the patch level of devices with corporate access, especially for privileged accounts.

Detecting suspicious activity on corporate Android devices:

• Monitor in the SIEM for access from Android devices to corporate resources at unusual hours or from anomalous geographic locations.
• Review Microsoft 365 / Google Workspace authentication logs for access from Android devices with unrecognised versions or patch levels.

‍

Cybersecurity as a strategic priority

CVE-2025-48595 is a reminder of a reality security managers know but few organisations have fully resolved: mobile devices are the weakest link in the corporate security perimeter in 2026. They have access to all the organisation’s critical systems, are outside the IT team’s direct control when personal, and their patching cycle is unpredictable and slow. The 2026 DBIR, which we analysed last week, confirmed that vulnerability exploitation is now the #1 breach vector. CVE-2025-48595 is the manifestation of that pattern in the ecosystem every employee carries in their pocket.

‍

Apolo Cybersecurity: mobile device management and BYOD security in corporate environments

At Apolo Cybersecurity we help organisations manage the risk surface that Android mobile devices represent: MDM policy implementation requiring minimum patch levels, Android corporate and BYOD fleet patch level inventory and assessment, non-compliant Android device access detection, urgent employee communications about critical updates, and risk assessment in MDM-free environments where corporate access from personal devices is uncontrolled.

If your organisation has employees accessing corporate email, VPN or internal applications from Android devices and you have no visibility into what patch level they have installed, CVE-2025-48595 is the signal to change that.

‍