- Google has patched 107 vulnerabilities in Android, including two zero-day vulnerabilities that have already been exploited.
- The flaws affect the framework, system, kernel, and third-party components such as Arm, MediaTek, or Qualcomm.
- Critical denial-of-service and privilege escalation vulnerabilities have been fixed.
- It is essential to install the December security patches on Android phones as soon as possible.
Google has released its December security bulletin, confirming the patching of over one hundred vulnerabilities in Android . This patch package is particularly significant because it includes several critical flaws and two zero-day vulnerabilities that were already being exploited in targeted attacks. The update is being rolled out gradually to compatible devices worldwide, including those sold in Spain and the rest of Europe.
In total, the bulletin lists 107 security vulnerabilities across the framework, operating system, kernel, and third-party closed-source components . Many of these fixes are delivered in two patch levels, dated December 1st and 5th, which manufacturers integrate into their own custom interfaces before making them available to users.
More than 100 vulnerabilities: what Google has fixed
Google's technical document details that the 107 vulnerabilities affect different layers of Android , starting with the framework itself (the base on which many system functions and apps run), going through the system, the Linux kernel, and ending with proprietary third-party components integrated into numerous mobile phones.
Within this package, two zero-day vulnerabilities stand out, identified as CVE-2025-48633 and CVE-2025-48572 , both labeled as high severity. The company acknowledges that these flaws were being exploited in limited and highly targeted attacks, something typically associated with advanced surveillance campaigns or high-value targets, rather than mass attacks.
Google has not provided full technical details for security reasons, but has clarified that CVE-2025-48633 allows for the unauthorized disclosure of information , meaning it makes it easier for an attacker to access data that should remain protected. Meanwhile, CVE-2025-48572 is related to privilege escalation , a type of vulnerability that can grant an attacker more control over the device than a typical application should have.
In addition to these two zero-days, the bulletin includes a critical denial-of-service (DoS) vulnerability, CVE-2025-48631, located in the Android framework . A flaw of this type can cause the system to become unresponsive, crash, or enter reboot loops, significantly impacting the availability and stability of the device.
The report also mentions four more critical kernel vulnerabilities, registered as CVE-2025-48623, CVE-2025-48624, CVE-2025-48637, and CVE-2025-48638 . All of these are also privilege escalation issues, which are particularly concerning because they are located at the core of the operating system and can open the door to deep and difficult-to-detect attacks.
Manufacturers and components affected
The fixes are not limited to code developed directly by Google. The bulletin notes that some of the 107 bugs are found in proprietary third-party components , such as those included by manufacturers of processors and connectivity solutions widely used in the Android ecosystem.
Specifically, two vulnerabilities in Arm components , 17 in MediaTek components , 11 flaws in Qualcomm components , and 13 vulnerabilities in Unisoc chips have been fixed . These vendors supply hardware and firmware to a wide variety of mobile phone brands, so the fixes affect devices across very different price ranges and manufacturers.
According to available information, the affected Android versions range from Android 13 onwards , which implies a huge number of active mobile devices. Given the prevalence of these versions in the market, billions of devices could potentially be at risk if the patch is not applied.
Google structures updates into two patch levels: 2025-12-01 and 2025-12-05 . The first typically includes basic system and framework fixes, while the second adds more specific kernel and vendor-specific component fixes. In practice, the user sees a single update, but vendors can integrate these levels in stages to expedite deployment.
Impact on users in Spain and Europe
In everyday life, the main risk for European users is that, if the phone is not updated with the December patch , it could become the target of highly targeted attacks capable of stealing sensitive information or taking deeper control of the device.
Information disclosure flaws can allow an attacker to access personal data, credentials, application content, or memory fragments that should be protected. A privilege escalation issue, on the other hand, can facilitate the installation of malware with elevated permissions, the disabling of security measures, or more subtle spying on the device.
In Spain and the rest of the European Union, where the use of mobile banking , healthcare, and e-government services is widespread, the exploitation of these vulnerabilities could have a particularly significant impact . A compromised phone not only puts photos and personal conversations at risk, but also financial transactions, dealings with public agencies, and two-factor authentication.
Google emphasizes that these zero-days have been used in "limited and targeted" attacks , a term typically associated with advanced surveillance operations rather than massive malware campaigns. Industry reports indicate that similar vulnerabilities have been exploited in the past by spyware vendors such as NSO Group, Candiru, and Intellexa, which specialize in sophisticated interception tools.
How the patch arrives on Android phones
On Pixel phones, which are managed directly by Google, security updates typically arrive in the first few days of the month . In Spain, users of these devices receive the patch via OTA (over-the-air update) without needing to take any further action beyond accepting the download.
For other manufacturers present in Europe, such as Samsung, Xiaomi, OPPO, OnePlus, Motorola, and Realme, the rollout schedule depends on each brand and model . Flagship and the latest mid-range phones are usually the first to receive monthly patches, while older or entry-level devices may take several weeks, or even lose support altogether if they have reached the end of their update cycle.
It is important to note that many European manufacturers group security patches and minor system improvements into a single update, so the user may see a single package that includes interface changes, minor bug fixes, and the corresponding Android patch level for December.
Those with phones that are no longer supported—a common occurrence after several years of use—find themselves in a more precarious position: the device retains its functions, but it no longer receives patches for these types of vulnerabilities . In such cases, it's advisable to take extra precautions and seriously consider upgrading to a model that continues to receive updates.
Recommendations for protecting your mobile phone
Beyond Google's own patch, there are a number of basic measures, such as making backups , that can reduce the impact of these vulnerabilities , especially while the update is not yet available or on devices with limited support.
- Manually check for updates in the Settings menu > System > System update (or equivalent depending on the manufacturer's layer) and apply any available security patches from December.
- Keep all applications updated from Google Play, as some providers distribute additional fixes through Google Play Services and other system components.
- Avoid installing APK files from unverified sourcesThis reduces the likelihood of introducing malicious software that attempts to exploit privilege escalation or information leak vulnerabilities.
- Review permissions of the apps already installedpaying special attention to access to SMS, calls, contacts, microphone, camera, location and internal storage.
On devices that no longer receive official updates, it's advisable to limit their use to particularly sensitive operations , such as mobile banking or handling highly private data. It can also be helpful to use reputable security solutions , always in conjunction with prudent device usage.
Google's December bulletin reflects the extent to which Android security is an ongoing and complex process , involving vulnerabilities of varying severity distributed across the system, kernel, and components from multiple manufacturers. The patching of over one hundred vulnerabilities, including two zero-day exploits and several critical ones, strengthens the protection of millions of mobile devices, but also underscores the importance of installing updates as soon as they are available and maintaining prudent usage habits to reduce the scope for potential attackers.
