Android

Android is the open-source mobile operating system developed by Google, built on the Linux kernel and licensed under the Apache 2.0 and GPL licences. It is the world's most widely deployed mobile operating system, running on an estimated 72 per cent of global smartphones, spanning devices from Google's own Pixel range through major manufacturers including Samsung, Xiaomi, Oppo and others. Android's architecture layers the Linux kernel, hardware abstraction layer (HAL), Android Runtime (ART, successor to Dalvik), and the Android Framework (a Java-based API layer managing application permissions, inter-process communication and hardware access). Applications are sandboxed via SELinux mandatory access control and the Android permission model, which requires explicit user grant for sensitive capabilities.

In this briefing, Android versions 14, 15 and 16 are affected by CVE-2025-48595, an integer-overflow elevation-of-privilege flaw in the Android Framework layer that allows a malicious app to claim capabilities not granted at install time. CISA listed the flaw as actively exploited on 2 June 2026 with a 5 June federal deadline. Google's standard remediation PATH is the monthly Android Security Bulletin, through which the patch is distributed to Pixel devices directly and to other manufacturers via Android's Open Source Project.

Android's fragmentation across device manufacturers and carriers means security update timelines vary significantly from the Pixel reference track. Enterprise deployments using Android Enterprise Recommended (AER) programme devices receive monthly security patches as a programme requirement, but the broader consumer Android ecosystem includes many devices that receive delayed or no updates. The KEV listing of CVE-2025-48595 specifically creates a mandatory patch obligation for US federal agencies operating Android device fleets, and may trigger Mobile Device Management (MDM) quarantine policies that lock out unpatched devices.