InfoSecBulletin Cybersecurity for mankind
On Monday, Google released its monthly security updates for Android, addressing two vulnerabilities that have been exploited in the wild. The patch fixes 107 security issues across various components, including Framework, System, Kernel, and those from Arm, Imagination Technologies, MediaTek, Qualcomm, and Unison.
The two high-severity shortcomings that have been exploited are listed below:
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
CVE-2025-48633: An information disclosure vulnerability in Framework
CVE-2025-48572: An elevation of privilege vulnerability in Framework
Google has not provided details on the attacks, including their nature, whether they are linked, or their scale. The identities of those responsible remain unknown.
However, the tech giant acknowledged in its advisory that there are indications they “may be under limited, targeted exploitation.”
Also fixed by Google as part of the December 2025 updates is a critical vulnerability in the Framework component (CVE-2025-48631) that could result in remote denial-of-service (DoS) with no additional execution privileges needed.
The December security bulletin has two patch levels: 2025-12-01 and 2025-12-05. This allows manufacturers to quickly fix common vulnerabilities in Android devices. Users should update to the latest patch as soon as it’s available.
The update follows the company’s release of fixes three months ago for two serious vulnerabilities in the Linux Kernel (CVE-2025-38352, CVSS score: 7.4) and Android Runtime (CVE-2025-48543, CVSS score: 7.4) that could allow local privilege escalation.
