Google Android Framework Vulnerabilities 

Targeted Sectors

• General Android users

It is suspected that the targets will specifically include the following:

• Journalists
• Activists
• Government officials

Countries

• Not specified, but exploitation is noted as "limited, targeted".

BLUF

Two zero-day vulnerabilities in the Android framework (an information disclosure flaw and a privilege escalation flaw) are being actively exploited in targeted attacks.

Date of First Reported Activity

• Prior to December 1, 2025.

Date of Last Reported Activity Update

• December 1, 2025

CVEs and CVSS Vectors for 3.1

CVE-2025-48633 (Information disclosure)

CVS 3.1 Score and logic

CVSS:4.0 (6.8) AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:A/U:Amber

Nessus ID:

• There is no plugin ID associated with this vulnerability at this time

Is this on the KEV list?

• Not at this time

Patching / Mitigation

• hxxps://source.android.com/docs/security/bulletin/2025-12-01

CVS 3.1 Score and logic

CVE-2025-48572 (Improper input validation)

CVS 3.1 Score and logic

CVSS (8.5) 4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber

Nessus ID:

• There is no plugin ID associated with this vulnerability at this time

Is this on the KEV list?

• Not at this time

Patching / Mitigation

hxxps://source.android.com/docs/security/bulletin/2025-12-01

APT Names

• No specific APT groups have been named in relation to these two specific CVEs.

Associated Criminal Organization Names

• None specified

IOCs

• Not publicly available to prevent wider exploitation.

TTPs

• Limited information; the flaws allow for information access and privilege escalation within the Android framework. (TTP numbers not available).

Malware Names

• None specified

Suggested Rules / Potential Hunts

Suricata Rules

• None publicly available.

Sentinel Rules

• None publicly available.

Splunk Hunts

• Generic Splunk scenarios for detecting zero-day activity exist, but specific hunts for these CVEs are not public.

Delivery Method

• Specifics of the exploit chain not disclosed, likely involving a user action like visiting a malicious website or opening a malicious message.

Email Samples

• Not available

References

Android Security Bulletin (December 2025): source.android.com

CISA Known Exploited Vulnerabilities (KEV) Catalog: 

• hxxps://www.cisa.gov/known-exploited-vulnerabilities-catalog

CVE-2025-48572 Malwarebytes blog

• hxxps://www.malwarebytes.com/blog/news/2025/12/google-patches-107-android-flaws

The Hacker News

• hxxps://thehackernews.com/2025/12/google-patches-107-android-flaws.html 

CyberSecurity Help

• hxxps://www.cybersecurity-help.cz/vdb/SB2025120164

Android Bulletin

• hxxps://source.android.com/docs/security/bulletin/2025-12-01