It's bad enough when Google warns Android users about software vulnerabilities that could allow attackers to steal personal data from their phones. But it is even worse when Google tells us that these software flaws have been exploited. In this month's Android Security Bulletin, Google made a point of highlighting two software flaws, CVE-2025-38352 and CVE-2025-48543. Google says that "There are indications that [these Android operating system flaws] may be under limited, targeted exploitation."
Make sure you have the latest Android Security Update installed on your phone
CVE-2025-38352 affects the Android Kernel, or the brains of the Android operating system. The kernel keeps everything running smoothly. The vulnerability took place in the part of the Android system that handles the alarm clocks built into apps that make sure certain things are done at certain times. When two parts of the system try to clear the timers simultaneously, bad things can happen, and a hacker could use this flaw to access higher-level controls that could allow him to take control of deeper parts of the system.
The Android Security Update for September mentions CVE-2025-48543 and CVE-2025-38352. | Image credit-Google
Google, as noted, fixed this with a patch in the September 2025 Android update that was recently released. To make sure that your Android phone has been updated, go to Settings > About Phone > Android version > Android security update. If it says September 5, 2025, or later, this flaw is patched on your phone. If not, update your phone immediately.
The second flaw is CVE-2025-48543, which featured a serious flaw in Android Runtime (ART). This is the part of the phone that runs apps, and the vulnerability is a memory handling mistake. This is compared to a hotel that rents out a room, turns over the key, deletes the room, but forgets to cancel the key. A hacker with that key could still enter the room and take it over.
A hacker could develop a malicious app that exploits this vulnerability to get higher permissions than it should have. As a result, system processes that only Google or your phone manufacturer would normally control could be controlled by the malicious app resulting in access to your personal data and app credentials such as passwords.
Do you worry about exploited vulnerabilities?
Yes. I worry that hackers will take control of my phone.
66.67%
No. Come on, what are the odds of me being hacked?
33.33%
I don't think about it at all.
0%
As we mentioned earlier in the story, Google thinks that these flaws have been exploited, although these attacks could be limited to targeted Android users such as journalists, government workers, and activists.
Google, as noted, fixed this with a patch in the September 2025 Android update that was recently released. To make sure that your Android phone has been updated, go to Settings > About Phone > Android version > Android security update. If it says September 1, 2025 or later, the flaws are patched on your phone. If not, update your phone immediately.
What you should do now
What is worrisome is that Google says that CVE-2025-38352 and CVE-2025-48543 can be exploited without user interaction. This means that you do not have to tap on a specific link, open an attachment, or even click "Allow" on a permission box. Once the malware is on your phone, often in the form of a malicious app, you do not need to do anything to make the attack succeed.
This type of attack is concerning. Let's say that you find a coloring app on your phone that seems like fun. Normally, after you install the app on your phone, such malware might try to trick you into opening a link or pressing a button. But with this type of malicious app, it can run its attack in the background without you having to press or do anything to activate it once it is downloaded on your device.
Recommended Stories
What you need to do now is:
Update your phone.
Make sure that you have the latest Security update versions on your phone.
Run only trusted apps. Do not sideload apps from third-party app storefronts.
Keep Google Play Protect enabled to help catch malicious apps before they cause serious issues for you.
You might not take these monthly security updates seriously. Even if you don't, you really should take the time to install the latest release every month.
"Iconic Phones" is coming this Fall!
Good news everyone! Over the past year we've been working on an exciting passion project of ours and we're thrilled to announce it will be ready to release in just a few short months.
"Iconic Phones: Revolution at Your Fingertips" is a must-have coffee table book for every tech-head that will bring you on a journey to relive the greatest technological revolution of the 21st century. For more details, simply follow the link below!
Alan, an ardent smartphone enthusiast and a veteran writer at PhoneArena since 2009, has witnessed and chronicled the transformative years of mobile technology. Owning iconic phones from the original iPhone to the iPhone 15 Pro Max, he has seen smartphones evolve into a global phenomenon. Beyond smartphones, Alan has covered the emergence of tablets, smartwatches, and smart speakers.
A discussion is a place, where people can voice their opinion, no matter if it
is positive, neutral or negative. However, when posting, one must stay true to the topic, and not just share some
random thoughts, which are not directly related to the matter.
Things that are NOT allowed:
Off-topic talk - you must stick to the subject of discussion
Offensive, hate speech - if you want to say something, say it politely
Spam/Advertisements - these posts are deleted
Multiple accounts - one person can have only one account
Impersonations and offensive nicknames - these accounts get banned
To help keep our community safe and free from spam, we apply temporary limits to newly created accounts:
New accounts created within the last 24 hours may experience restrictions on how frequently they can
post or comment.
These limits are in place as a precaution and will automatically lift.
Moderation is done by humans. We try to be as objective as possible and moderate with zero bias. If you think a
post should be moderated - please, report it.
Have a question about the rules or why you have been moderated/limited/banned? Please,
contact us.
FCC OKs Cingular\'s purchase of AT&T Wireless
Things that are NOT allowed:
To help keep our community safe and free from spam, we apply temporary limits to newly created accounts: