Google Android June 2026 Patches 124 Flaws with CVE-2025-48595 Actively Exploited and a CISA Deadline of 5 June

Google has released its June 2026 Android security update, patching 124 vulnerabilities across the platform. One flaw, tracked as CVE-2025-48595, stands apart: it is under active exploitation, enables local privilege escalation with no user interaction required, and has been added to the CISA Known Exploited Vulnerabilities catalog with a June 5 remediation deadline for US federal agencies.

For enterprise security teams managing Android device fleets across the GCC, this update is not a routine patch cycle item. The combination of active exploitation, zero required user interaction, and broad version coverage across Android 14, 15, and 16 makes CVE-2025-48595 an immediate priority for mobile device management policy review and forced update deployment.

Active Exploitation Confirmed: CISA KEV Added 2 June 2026CISA added CVE-2025-48595 to its Known Exploited Vulnerabilities catalog on 2 June 2026. Federal civilian agencies are required to remediate by 5 June 2026. Google has acknowledged limited, targeted exploitation is already occurring. Enterprise teams must treat this as an active threat, not a future risk.

CVE-2025-48595: What Security Teams Need to Know

The vulnerability exists in multiple locations within the Android Framework component. An integer overflow condition can be triggered to achieve code execution, which then enables local privilege escalation. Because no user interaction is required and no additional execution privileges are needed, the attack chain is short and reliable.

Google has acknowledged that CVE-2025-48595 may be under limited, targeted exploitation, using language consistent with how the company characterises flaws that have been observed in use by commercial spyware vendors or state-linked threat actors against high-profile individuals. While Google has not attributed the exploitation or identified specific targets, the pattern of zero-interaction privilege escalation flaws in the Android Framework being weaponised by advanced threat actors to target enterprise and government accounts is well established in the threat intelligence record.

The Full Patch Package: Two Security Levels

Google has released two patch levels for June 2026. The 2026-06-01 patch level addresses the Framework and System component vulnerabilities. The 2026-06-05 patch level includes everything in the first set plus patches for kernel components and third-party chipset firmware from Imagination Technologies, MediaTek, Qualcomm, and Unisoc.

Beyond CVE-2025-48595, several additional vulnerabilities in the System component could also lead to local privilege escalation without additional execution privileges needed. Enterprise teams should apply the 2026-06-05 level to capture the complete set of fixes including chipset-level patches.

What GCC Enterprise Teams Should Do Now

For organisations managing enterprise Android fleets across the Gulf region, the presence of an actively exploited zero-interaction privilege escalation flaw in the Android Framework demands immediate action through mobile device management platforms. Waiting for devices to update organically is not an acceptable response when CISA has confirmed active exploitation and set a three-day remediation window for federal agencies.

• Force the June 2026 update across all managed Android devices immediately
  Use your MDM platform to push the 2026-06-05 patch level to all devices running Android 14, 15, or 16. Do not wait for users to apply updates manually.
• Audit unmanaged BYOD devices accessing corporate resources
  Enterprise email, VPN, and application access from personal Android devices running unpatched firmware represents an active attack surface. Enforce minimum patch level requirements via conditional access policies.
• Review mobile threat defence telemetry for exploitation indicators
  Given Google's acknowledgement of limited targeted exploitation, security teams with mobile threat defence tooling should review recent alerts for privilege escalation or unexpected code execution patterns on Android endpoints.
• Apply the 2026-06-05 patch level, not just 2026-06-01
  The second level includes chipset patches from MediaTek, Qualcomm, and others that are not included in the first level. Devices in the GCC market commonly use MediaTek and Qualcomm chipsets requiring these additional fixes.

The broader context reinforces urgency. As documented in our coverage of Iranian APT activity targeting UAE and Saudi enterprises, mobile device compromise is an established entry point for nation-state threat actors operating in the GCC. The combination of an actively exploited Android Framework privilege escalation flaw and a known elevated threat environment across the region makes the June 2026 update a security operations priority, not a scheduled maintenance item. AI-assisted mobile threat detection tools should be configured to flag anomalous privilege escalation events on Android endpoints as an immediate investigation trigger.