Android on alert: day zero already exploded in the security patch of June 2026 and 124 vulnerabilities to correct

Google has published Android's June 2026 security patches to correct 124 vulnerabilities, including at least one zero-day failure that is already being exploited in targeted attacks. The most outstanding correction responds to the failure identified as CVE-2025-48595, a vulnerability of the Android Framework that allows a local attacker to run code and scale privileges on Android devices 14 or higher, according to the official Google newsletter.

The official notice recalls that there are indications of limited and managed exploitation of this failure, but does not yet provide technical details on the attack vector or on the specific objectives. Historically, similar failures have been used by commercial spyware and state-sponsored operations to engage high-profile people, so early detection and early correction are critical.

In addition to the zero-day, the June patch corrects 18 critical vulnerabilities distributed between system components, the framework and closed components of Qualcomm, which could allow from denial of service to lifting of remote privileges without user interaction in some cases. Google published two levels of patch, the 2026-06-01 and 2026-06-05 the latter is the one that brings together all the additional corrections for third-party and kernel subcomponents that do not apply to all devices.

It is important to understand that Google Pixel will receive updates immediately but third-party manufacturers (Samsung, Xiaomi, OPPO, etc.) often take more time to adapt and test patches to their hardware and customizations. For users and administrators this implies a variable exposure window according to the device's brand and model.

The practical implications are clear: if an attacker achieves local access to the device - for example through a malicious app installed, prior exploitation of other vulnerability or momentary physical access - he can try to take advantage of CVE-2025-48595 to obtain control of sensitive functions and evade protections. In corporate environments this could result in the theft of credentials, espionage or lateral movement into connected resources.

I recommend as immediate measures that all users check their patch level in Settings > System > Phone information and, if available, install the update. Update as soon as the supplier publishes your patch is the most effective defense. For those who cannot apply the patch immediately, it is appropriate to minimize exposure: do not install applications outside official stores, refuse unnecessary permissions, disable USB debugging (ADB) and use strong screen lock.

For security teams and IT administrators, in addition to deploying updates, it is recommended to implement mobile device management policies (MDM / EMM) that restrict the installation of apps, force automatic updates where possible and monitor telemetry in search of compromise indicators such as unusual processes, abnormal battery consumption or network traffic to suspicious destinations.

If you suspect that a device was already compromised, consider isolating it from the network, revoke associated credentials (accounts, tokens), review the list of installed applications and proceed to a complete restoration after supporting essential data. For cases of high risk or suspicion of advanced spyware, seek professional assistance in response to incidents or contact your security provider.

This episode fits one trend: Google has been cataloguing several corrections such as "in limited and directed exploitation" in recent months and, in parallel, has adjusted its reward programs for vulnerabilities, offering great incentives for high-impact Android exploits. To follow official information about these patches, see the Android newsletter on the Google Security site and centralized vulnerability resources such as NIST NVD: Android Security Bulletin and NVD - National Vulnerability Database.

In short, the emergence of a locally exploited zero day reinforces two classic lessons: keep systems up-to-date and reduce attack surface. For most users the concrete and most effective action today is to check the safety patch and apply the update as soon as your manufacturer distributes it.