Google’s Latest Android Update Fixes 84 Vulnerabilities

What “84 Vulnerabilities” Really Means (and Why the Count Can Look Confusing)

Android security updates often get summarized with a single headline number, but the Android ecosystem is a layered cake:
there’s the core Android platform (AOSP), plus device-maker changes, plus chipset vendor components, plus Google Play system modules.
Some reports focus on the “headline” set of issues for the main patch rollout, while others include additional vendor and driver fixes.

For this update, many mainstream write-ups emphasized 84 fixed vulnerabilities, while other breakdowns discussed totals above 100
when adding chipset-vendor components (especially Qualcomm) or when counting every defect enumerated across patch levels.
The important takeaway is not the scoreboardit’s that this update includes two exploited privilege-escalation flaws and at least one
critical bug category that can be extremely dangerous if you’re behind on patches.

Google also structures monthly security fixes into two patch levels (for example, 2025-09-01 and 2025-09-05),
allowing Android partners to ship a “good” patch quickly and a “better” patch once more device-specific fixes are integrated.
When in doubt, aim for the later patch levelit includes everything earlier plus more.

The Two Vulnerabilities Under Active, Targeted Exploitation

The scariest part of this update isn’t that the list is long. It’s that Google flagged two vulnerabilities as potentially being exploited
in “limited, targeted” attacks. That phrase usually means: not a random internet free-for-all (yet), but potentially used by sophisticated actors
against specific peoplejournalists, activists, executives, government staff, or anyone who’d look interesting on a spy’s bingo card.

1) CVE-2025-38352: Linux Kernel POSIX CPU Timers Race Condition (Privilege Escalation)

This one lives in the Linux kernel’s POSIX CPU timers subsystemdeep plumbing that helps manage how processes track CPU time.
In plain English: it’s low-level, widely used, and the kind of place where subtle timing bugs can become major security problems.

The issue is essentially a race conditiontwo operations happening in an unlucky orderthat can lead to instability and, under the wrong conditions,
privilege escalation. Privilege escalation is the security equivalent of finding a staff-only door in a building:
you start as a normal visitor (a regular app), then suddenly you’re in the control room (system-level privileges).

Why that matters: a malicious app doesn’t have to be flashy. It can look boring, behave politely for days,
and then use a kernel-level bug to gain more power than it should. Once an attacker has elevated privileges, they can potentially:

• Access or alter sensitive data beyond normal app permissions
• Disable or evade certain security controls
• Persist more effectively (sticking around even after you think you removed the problem)

This CVE is also notable because U.S. government vulnerability tracking has treated it as exploited-in-the-wild,
which is a strong signal that defenders should prioritize patching.

2) CVE-2025-48543: Android Runtime (ART) Use-After-Free (Privilege Escalation)

The Android Runtime (ART) is where a huge amount of Android app code actually runsespecially Java and Kotlin apps and many system services.
A memory corruption bug in ART is like discovering the hotel master key works on random rooms:
it’s not guaranteed chaos, but it’s an obvious problem once someone figures out the right twist.

This vulnerability is described as a use-after-free, a classic memory-safety issue.
In broad terms, it can allow an attacker to escape intended isolation boundaries and escalate privileges.
The NVD description even mentions a path involving escaping a sandbox and reaching highly privileged processesexact exploit chains vary,
but the theme is consistent: getting more control than you’re supposed to have without the user doing anything.

Put differently: if the kernel bug is “break into the building,” the ART bug is “walk past internal security checkpoints.”
Either one is bad. Together, they’re a reason to stop postponing updates.

More Than a Number: The Critical Bugs You Don’t Want to Ignore

Beyond the two exploited vulnerabilities, reports highlighted additional critical-severity issues addressed in this update.
“Critical” isn’t marketing dramait’s typically reserved for bugs that can lead to outcomes like remote code execution (RCE)
or severe compromise paths without extra privileges or user interaction.

Proximity / Adjacent Remote Code Execution: When “Nearby” Is Too Close

One critical category discussed is a remote (proximal/adjacent) code execution issue in the System component.
“Proximal/adjacent” often means an attacker needs to be on the same network or within range of wireless communications
(think Wi-Fi or Bluetooth). That’s not “from across the planet,” but it’s also not comforting if you spend time in airports,
conferences, cafés, or anywhere your phone is chatting with the world.

The practical risk isn’t that every coffee shop has an evil genius in the corner. It’s that devices that are consistently behind on patches
are easier to target when the opportunity arises. Security is rarely about one dramatic moment; it’s about reducing the number of “easy days”
attackers can have.

Chipset Vendor Components: Why Some Totals Jump Above 100

Some outlets and security blogs discussed totals like 111 or 120 defects fixed when including chipset-related components
(particularly Qualcomm) and other partner patches. If your phone uses a chipset affected by vendor vulnerabilities,
those fixes matterespecially when critical issues touch modem or networking components.

This is also why Android patch rollouts can feel “uneven.” Google can publish the bulletin and provide patches,
but device manufacturers must integrate those fixes into their builds, validate them across models, and ship them through carriers and regions.
Pixels tend to get updates fast; other brands may lag. None of this helps you if you’re the last one in line.

Why Attackers Love Unpatched Phones (and Why You’re Not “Too Boring” to Target)

It’s tempting to think, “I’m not famous. Nobody’s coming for my phone.” But most attacks aren’t personalthey’re opportunistic.
Attackers look for scale: devices that are late on updates, users who sideload apps, and organizations with weak mobile policies.

The two exploited vulnerabilities in this update are privilege-escalation bugs. That means attackers can start from a foothold
(like a malicious app or a chained exploit) and climb upward. The end goal might be:

• Data theft: messages, tokens, files, photos, or app data
• Account takeover: especially when authentication tokens can be accessed
• Surveillance: location tracking, microphone access, or persistent monitoring (in targeted scenarios)
• Business risk: corporate email, Slack/Teams, VPN credentials, and internal documents on BYOD devices

Even if you never become a “target,” you can still become a “convenient stepping stone.”
And hackers love convenience. It’s basically their brand.

How to Check Your Android Security Patch Level (and Update Like You Mean It)

Security updates aren’t just “new emojis” (though we support joyful living). They’re the mechanism that closes known holes.
Here’s how to check where you stand:

Step-by-step: Find your security patch level

1. Open Settings
2. Go to About phone (or System → About phone, depending on your device)
3. Tap Android version or Software information
4. Look for Android security patch level

If you see a patch level earlier than the one associated with this security release (for example, earlier than 2025-09-05),
you’re likely missing protections against the exploited vulnerabilities discussed above.

Step-by-step: Install the update

1. Go to Settings → System → Software update (or System update)
2. Tap Check for updates
3. Install, reboot, and then check the patch level again

Don’t forget Google Play system updates

Some security improvements can arrive through Google Play system updates (Project Mainline modules),
which are separate from full OS updates. If your device supports it, update that too:

1. Settings → Security & privacy (or Security)
2. Look for Google Play system update
3. Install and reboot if prompted

If You’re Waiting on Your Manufacturer: Risk-Reducing Moves That Actually Help

Not everyone gets patches on day one. If your update is “rolling out” (a phrase that feels suspiciously like “eventually, maybe”),
you can still reduce risk while you wait:

1) Keep Play Protect on, and keep your apps updated

Google Play Protect adds scanning and abuse monitoring that can help catch harmful appsespecially important if an exploit chain begins with a malicious app.
Also update apps from the Play Store, since attackers love pairing OS bugs with outdated apps.

2) Avoid sideloading apps (especially “APK deals”)

A privilege-escalation bug becomes dramatically more useful once a malicious app is on the device.
If you must sideload (developers, we see you), stick to trusted sources and verify signaturesotherwise you’re basically
inviting a stranger to house-sit because they said they “seem chill.”

3) Be smart about wireless exposure

Because some critical issues can involve proximity vectors, reduce exposure in high-risk environments:
disable Bluetooth when you don’t need it, avoid connecting to sketchy Wi-Fi, and consider using a reputable VPN on public networks.

4) If your phone is stuck on an old Android version, make a plan

Devices that no longer receive security updates are like doors that never get new locks.
If you’re on a very old Android version (often Android 12 or earlier on many models, depending on manufacturer support),
it may be time to upgrade to a phone with a strong update commitment.

What This Means for Businesses and IT Teams (Yes, Even Small Ones)

Mobile devices aren’t “just phones” anymore. They’re authentication hubs, password vault portals, document readers, and VPN endpoints
that happen to also take photos of your lunch.

Patch prioritization: treat exploited vulnerabilities as emergencies

When vulnerabilities are flagged as exploited (even “limited, targeted”), patch prioritization should jump.
You don’t need sensational headlines to justify action; you need a clear policy:
exploited vulnerabilities are patch-now, not “patch during the next quarterly refresh.”

Practical moves that work in the real world

• Inventory: know which devices and OS versions are in your fleet
• Minimum patch level: require a baseline (and block access if devices fall behind)
• MDM enforcement: reduce sideloading, restrict risky developer options, and enforce screen lock + encryption
• BYOD clarity: if employees use personal phones for work, define patch requirements

The best mobile security program isn’t the one with the most slidesit’s the one that ensures people actually update.
(Shockingly, policy PDFs do not install patches by themselves.)

Real-World Experiences: What Patch Week Looks Like When “84 Vulnerabilities” Drops

When a major Android security update lands, the experience is rarely uniformand that’s part of the problem.
In the real world, “Google released fixes” often translates to “some devices are protected quickly, others enter the
Waiting Room of Eternal Rollouts.” If you’ve ever watched a friend’s Pixel update immediately while your phone insists
“Your system is up to date” (with a patch level from the Stone Age), you already know the vibe.

A common pattern looks like this: security news breaks, tech sites highlight the headline number, and suddenly group chats turn into
mini IT departments. Someone asks, “Should I update?” Someone else says, “I never update and I’m fine,” which is like bragging
you never wear a seatbelt and you’re still heretechnically true, wildly unhelpful.

Meanwhile, IT teams and security-minded folks do the same three things every month, just with more caffeine:
they check whether the update includes exploited vulnerabilities, they identify which models in their fleet will receive the patch,
and they try to close the gap between “patch exists” and “patch is installed.” That last gap is where risk lives.

On the user side, the most relatable “experience” is the tradeoff anxiety: “Will this update break my battery?”
It’s not an irrational fearbad updates happenbut security updates are designed to be routine maintenance.
The bigger risk is letting known, exploited vulnerabilities sit on your device because you’re worried an icon might move.
Most of the time, the update is a non-event. And in security, a non-event is the dream.

Another real-world moment: the “permissions wake-up call.” People read about privilege escalation and suddenly notice they’ve granted
flashlight apps access to contacts, microphone, location, and probably their childhood diary. Big security updates are a great trigger
to do a five-minute permission audit: remove apps you don’t use, revoke permissions that don’t make sense, and enable Play Protect.
You don’t need to become a cybersecurity wizardjust stop giving random apps the keys to your house.

For power users and developers, patch week can also mean testing and validation: checking that device management tools still behave,
confirming that corporate VPN and authentication apps still work, and making sure nothing mission-critical breaks.
The experience tends to reinforce one simple truth: Android security is a team sport.
Google can publish the fixes, chipset vendors can ship driver updates, manufacturers can package them, carriers can approve them
but the last mile is still the user tapping “Install.” That’s why the most effective security habit is boring:
update promptly, reboot when asked, and move on with your life.

Conclusion: The Best Time to Patch Was Yesterday. The Second-Best Time Is Right Now.

“Google’s latest Android update fixes 84 vulnerabilities” sounds like a big numberand it is.
But the real headline is simpler: two vulnerabilities associated with privilege escalation were flagged as exploited in targeted attacks,
and the update closes those doors. Whether your device gets patches instantly or on a slower schedule, you should aim to reach the latest
security patch level available for your phone as soon as it appears.

If you take only one action today, make it this: check your Android security patch level, install updates, and reboot.
It’s the most boring, effective security move you can makeand honestly, boring is what we want.