Android has a series of serious vulnerabilities, more than 1 billion devices cannot be fixed

Google has issued a critical warning to all Android users, confirming that two separate vulnerabilities have been exploited in the wild. This month's security update is so severe that Google will quickly patch all eligible Pixel devices.

The two critical vulnerabilities exploited — CVE-2025-38352 and CVE-2025-48543 — affect the Android Kernel and Android Runtime, respectively. As usual, Google has not released any critical details at this early stage.

Extremely serious security holes on Android have just been discovered.

There are also four other important fixes — CVE-2025-48539, CVE-2025-21450, CVE-2025-21483, and CVE-2025-27034. The first fix concerns the Android System, while the other three concern Qualcomm chipsets and manufacturer patch releases.

Google says CVE-2025-48543 and CVE-2025-38352 are worrisome, and both “can lead to local escalation of privilege without requiring additional execution privileges.” More alarmingly, “no user interaction is required for exploitation.”

While Pixels will be updated immediately, other OEMs will receive the code patch “within the next 48 hours” and will need to update their own monthly bulletins and firmware releases. You can expect a regular rollout schedule in the coming weeks.

A timely reminder that only devices that are still eligible for monthly security updates will get these fixes. More than a billion Android phones are no longer under any form of support contract, and many are running versions of Android that can’t be updated.

More than 1 billion devices running Android 12 or earlier are at risk.

This is exactly why owners of these older devices are encouraged to upgrade their phones if they cannot update the software. Until you do, your data and device are at risk.

As Zimperium warns, “a significant percentage (25.3%) of devices cannot be upgraded because they are old.” And delays in updating make the problem worse. “At any given time during the year, more than 50% of mobile devices are running an outdated version of the operating system, and a significant number are compromised or infected with viruses.”

The U.S. Cyber Defense Agency added both Android security threats to its Known Exploited Vulnerabilities (KEV) catalog on September 4. Federal employees have until September 25 to update or stop using their Android devices. Obviously, in the unlikely event that any devices that cannot be updated are still in use by federal agency employees, those devices will need to be upgraded to new hardware before the deadline.