FlagThis

Google has released its April 2025 Android security update, addressing a total of 62 vulnerabilities. This includes fixes for two actively exploited zero-day vulnerabilities. The security bulletin addresses vulnerabilities across system components, the Linux kernel, and third-party hardware drivers, highlighting the importance of applying updates promptly. The two high-severity zero-days were reportedly used in targeted surveillance operations.

The exploited vulnerabilities are identified as CVE-2024-53150 and CVE-2024-53197. CVE-2024-53150 is an Android Kernel information disclosure vulnerability caused by an out-of-bound read weakness, potentially allowing local attackers to access sensitive information. CVE-2024-53197 is a high-severity privilege escalation flaw in the Linux kernel’s USB-audio driver for ALSA devices.

The privilege escalation flaw, CVE-2024-53197, was reportedly exploited by Serbian authorities to unlock confiscated Android devices. This was part of a zero-day exploit chain developed by Cellebrite, an Israeli digital forensics company. The exploit chain also included CVE-2024-53104, patched in February 2025, and CVE-2024-50302, patched last month. With this latest update, all three vulnerabilities in that chain are now fixed. Users are advised to apply the updates as soon as they are released by Android original equipment manufacturers (OEMs).

ImgSrc: mnwa9ap4czgf-u1

References :

• CyberInsider: Google Patches Actively Exploited Android Zero-Day Vulnerabilities
• discuss.privacyguides.net: Google just fixed two critical Android zero-days and 60 other flaws
• The Hacker News: Google Releases Android Update to Patch Two Actively Exploited Vulnerabilities
• BleepingComputer: Google fixes Android zero-days exploited in attacks, 60 other flaws
• securityaffairs.com: Google addressed 62 vulnerabilities with the release of Android ‘s April 2025 security update, including two actively exploited zero-days.
• cyberinsider.com: Google’s April 2025 Android Security Bulletin addresses 60 vulnerabilities across system components, the Linux kernel, and third-party hardware drivers, including two high-severity zero-days that have been actively exploited in targeted surveillance operations.
• Threats | CyberScoop: Google addresses 2 actively exploited vulnerabilities in security update
• techcrunch.com: Google fixes two Android zero-day bugs actively exploited by hackers
• Malwarebytes: Google fixes two actively exploited zero-day vulnerabilities in Android
• cyberscoop.com: Google addresses 2 actively exploited vulnerabilities in security update
• techcrunch.com: Google fixes two Android zero-day bugs actively exploited by hackers
• MSSP feed for Latest: Google Patches Two Zero-Days in April 2025 Android Security Update
• infosec.exchange: NEW: Google has pushed out patches for two zero-days that were being (and may still be) exploited in the wild. Amnesty previously found that one of them was being used against a student activist in Serbia, by Serbian authorities armed with Cellebrite.
• Cyber Security News: Google addressed 62 vulnerabilities with the release of Android ‘s April 2025 security update, including two actively exploited zero-days.

Classification:

• HashTags: #AndroidSecurity #ZeroDay #SecurityUpdates
• Company: Google
• Target: Android Users
• Product: Android
• Feature: Security Patches
• Malware: CVE-2024-53150, CVE-2024-53197
• Type: Vulnerability
• Severity: Major