Google Patches Android 0-Day Actively Exploited in the Wild

The April 2025 Android Security Bulletin addresses 58 vulnerabilities across multiple system components, including critical remote code execution risks and actively exploited zero-day flaws.

Published on April 7, 2025, the update mandates security patch levels of 2025-04-05 or later to fully resolve these issues.

Critical Vulnerabilities Under Active Exploitation

Two vulnerabilities show evidence of limited, targeted exploitation in the wild:

• CVE-2024-53150: USB subsystem information disclosure (High severity)
• CVE-2024-53197: USB driver privilege escalation (High severity)

The most severe patched flaw is CVE-2025-26416, a critical remote escalation of privilege in the System component requiring no user interaction.

Another critical denial-of-service vulnerability (CVE-2025-22423) affects the same component.

Component-Specific Vulnerabilities

Framework

• CVE-2025-22429: Critical information disclosure allowing unauthorized data access
• 10 high-severity elevation of privilege (EoP) vulnerabilities across Android 13-15

System

• Critical: CVE-2025-26416 (EoP) and CVE-2025-22423 (DoS)
• 12 high-risk EoP flaws in components like media processing and network stacks

Kernel

• CVE-2024-50264: High-severity Net subsystem EoP
• CVE-2024-56556: Binder IPC privilege escalation

Hardware-Specific Patches

Vendor	Critical CVE	Impact
Qualcomm	CVE-2024-45551	Closed-source RCE
MediaTek	CVE-2025-20655	Keymaster compromise
Imagination Tech	7 GPU vulnerabilities	PowerVR GPU exploits

The Qualcomm CVE-2024-45551 represents a particular concern as it affects closed-source bootloader components, complicating third-party vulnerability analysis.

Mitigation Requirements

Android partners must implement:

1. Dual patch levels:

• 2025-04-01 for framework/system fixes
• 2025-04-05 for kernel/hardware updates

1. Google Play System Updates for Mainline Components:

• Documents UI (CVE-2025-22439)
• MediaProvider (CVE-2024-49730)

1. OEM-specific binary driver updates for closed-source components

Security Protocol Updates

The bulletin emphasizes:

• Mandatory SELinux policy enhancements for system services
• Improved memory sanitation in Bionic libraries
• Updated seccomp filters for media codecs

Google Play Protect has added 23 new detection signatures related to these vulnerabilities, particularly targeting sideloaded apps attempting to exploit USB subsystem flaws.

Implementation Timeline

• April 9, 2025: AOSP patches available for OEM integration
• April 15, 2025: Deadline for Google Pixel updates
• May 1, 2025: Recommended consumer deployment date

This update cycle marks the first use of parallel patch levels (04-01 and 04-05) to accelerate critical fixes while maintaining hardware partner flexibility.

Devices must be shown ro.build.version.security_patch:[2025-04-05] to confirm full compliance.

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates