--- title: "September 2025: Google fixes 120 Android vulnerabilities, including 2 zero-days" description: Google patches 120 Android vulnerabilities, including 2 zero-days already exploited, showing why strong mobile security is essential. image: https://blog.pradeo.com/hubfs/Template%20article.png --- [![pradeo_logo_color](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_color.png?width=220&height=33&name=pradeo_logo_color.png "pradeo_logo_color")](https://pradeo.com) - Solutions - [Mobile Threat Defense](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Secure Private Store](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Mobile Application Compliance Audit](https://pradeo.com/en/solutions/mobile-application-security/application-compliance-audit/) - [Runtime Application Self Protection](https://pradeo.com/en/solutions/mobile-application-security/rasp/) - [Shielding](https://pradeo.com/en/solutions/mobile-application-security/application-shielding/) - [Application Security Testing](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - Use cases - [Cybersecurity in MDM/ UEM](https://pradeo.com/en/use-cases/cybersecurity-in-mdm-uem/) - [Securing mobile devices](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Securing Mobile Applications](https://pradeo.com/en/solutions/mobile-application-security/application-security-testing/) - [Malware / leakware protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Phishing protection](https://pradeo.com/en/solutions/mobile-device-security/mobile-threat-defense/) - [Ensuring compliance for applications](https://pradeo.com/en/compliance/) - [Ensuring compliance for mobile fleet](https://pradeo.com/en/compliance/) - [Securing BYOD](https://pradeo.com/en/solutions/mobile-device-security/secure-private-store/) - [Become partner](https://pradeo.com/become-partner/) - Resources - [Solution briefs](https://pradeo.com/en/resources/?solution-briefs) - [Customer Cases](https://pradeo.com/en/resources/?customer-cases) - [Integration briefs](https://pradeo.com/en/resources/?integration-briefs) - [White Papers](https://pradeo.com/en/resources/?white-papers) - [Analyst reports & guides](https://pradeo.com/en/resources/?analyst-reports-guides) - [On demand webcast](https://pradeo.com/en/resources/?webcasts-on-demand) - [About us](https://pradeo.com/en/about/) - [Blog](https://blog.pradeo.com/) - [Contact](https://pradeo.com/contact/) - en - [**FR**](https://blog.pradeo.com/fr) - [**DE**](https://blog.pradeo.com/de) ### Topics - Select a Topic ### Stay up to date SUBSCRIBE TO OUR BLOG ### Stay up to date [Actualité](https://blog.pradeo.com/topic/actualité) # September 2025: Google fixes 120 Android vulnerabilities, including 2 zero-days ![Picture of Roxane Suau](https://blog.pradeo.com/hubfs/roxane-suau.jpg) By [Roxane Suau](https://blog.pradeo.com/author/roxane-suau) on September, 24 2025 [mailto:?subject=Take%20a%20look%20at%20this%20article](mailto:?subject=Take%20a%20look%20at%20this%20article) ![](https://blog.pradeo.com/hubfs/Template%20article.png) ###### At the beginning of September 2025, Google released its monthly Android security update. And this time, the numbers are striking: a total of 120 vulnerabilities, compared to only 6 last month. Among them, two zero-day vulnerabilities had already been exploited by cybercriminals before the fix was made available. ## A Massive and Critical Patch Among the 120 vulnerabilities patched, two are particularly concerning because they were already being actively exploited at the time of the patch: - CVE-2025-38352: a flaw in the Android system allowing a malicious application to gain more privileges than intended - CVE-2025-48543: a vulnerability in the Android runtime, allowing system protections to be bypassed These two vulnerabilities can be seen as true entry points, giving cybercriminals the ability to escalate privileges and override the security mechanisms meant to protect data. Beyond these two critical flaws, the September patch also addresses numerous other vulnerabilities in the Android system and in chips from manufacturers such as Qualcomm and MediaTek. Notably, a Remote Code Execution (RCE) vulnerability was fixed in the System component, which could have allowed a cybercriminal to take full remote control of a device. ## Why Businesses Should Care Today, smartphones are true work tools: professional messaging, access to business applications, sharing of sensitive documents… When an Android zero-day vulnerability is exploited, organizational data and security are directly at risk. Two major challenges aggravate the situation: - Android fragmentation: not all devices receive updates at the same time, leaving some exposed longer - BYOD (Bring Your Own Device): many employees use their personal phones, with no guarantee they are up to date ## Protection Beyond Updates Installing the September patch is essential. But between the discovery of a vulnerability and the release of a patch, there is always a window of exposure during which cybercriminals can exploit zero-days. Moreover, not all devices receive updates at the same time, especially in BYOD environments. The Pradeo Mobile Threat Defense (MTD) solution provides continuous protection by: - Detecting suspicious behaviors in real time related to vulnerability exploitation - Automatically blocking malicious applications or connections - Offering security teams clear visibility into each device’s status and patch level - Protecting sensitive data even in hybrid or BYOD environments The leap from 6 vulnerabilities fixed in August to 120 in September is a strong warning. To counter fast-evolving and sophisticated threats, businesses need mobile solutions that continuously detect, block, and protect. With Pradeo, they remain one step ahead of cybercriminals.             ###### About The Author [More from this author](https://blog.pradeo.com/author/roxane-suau) ![](https://blog.pradeo.com/hs-fs/hubfs/roxane-suau.jpg?height=100&name=roxane-suau.jpg) ###### Roxane Suau #### Recommended articles [![Pradeo wins the hackathon organized by Campus Cyber and the DGSE](https://blog.pradeo.com/hubfs/Hackaton%201.jpg)](https://blog.pradeo.com/pradeo-wins-hackathon-campus-cyber-dgse-) ###### [Pradeo wins the hackathon organized by Campus Cyber and the DGSE](https://blog.pradeo.com/pradeo-wins-hackathon-campus-cyber-dgse-) - November 22, 2023 ### Popular articles ### Stay up to date ### Recent articles ### Articles récents [Android: The 4th zero-day vulnerability patched in six months](https://blog.pradeo.com/android-the-4th-zero-day-vulnerability-patched-in-six-months-1) - 24 September, 2025 [Vibe Coding: when AI-generated code multiplies vulnerabilities](https://blog.pradeo.com/vibe-coding-when-ai-generated-code-multiplies-vulnerabilities) - 24 September, 2025 [2026 World Cup: Cyberattacks Target Fans' Mobile Devices](https://blog.pradeo.com/2026-world-cup-cyberattacks-target-fans-mobile-devices) - 24 September, 2025 [Signal: a phishing campaign targets users' backups](https://blog.pradeo.com/signal-a-phishing-campaign-targets-users-backups) - 24 September, 2025 [Morpheus Spyware: a fake Android application used for smartphone surveillance](https://blog.pradeo.com/morpheus-spyware-a-fake-android-application-used-for-smartphone-surveillance) - 24 September, 2025 ### Topics - [Mobile Security (56)](https://blog.pradeo.com/topic/mobile-security) - [Mobile Application Security (46)](https://blog.pradeo.com/topic/mobile-application-security) - [Expertise (31)](https://blog.pradeo.com/topic/expertise) - [Security Alert (30)](https://blog.pradeo.com/topic/security-alert) - [Cybersecurity (29)](https://blog.pradeo.com/topic/cybersecurity) - [News (25)](https://blog.pradeo.com/topic/news) - [Partners (24)](https://blog.pradeo.com/topic/partners) - [Corporate (12)](https://blog.pradeo.com/topic/corporate) - [Events (4)](https://blog.pradeo.com/topic/events) - [Actualité (2)](https://blog.pradeo.com/topic/actualité) - [predictions (2)](https://blog.pradeo.com/topic/predictions) - [cyberattack (1)](https://blog.pradeo.com/topic/cyberattack) see all [![New Call-to-action](https://hubspot-no-cache-eu1-prod.s3.amazonaws.com/cta/default/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f.png)](https://hubspot-cta-redirect-eu1-prod.s3.amazonaws.com/cta/redirect/2378615/ad3111b0-9454-41ff-91f4-9eee95b1f08f) ### Get in touch with mobile security experts [Contact us](https://www.pradeo.com/en-US/contact-us) [![](https://blog.pradeo.com/hs-fs/hubfs/pradeo_logo_white_square.png?width=90&height=74&name=pradeo_logo_white_square.png)](https://pradeo.com) European leader in mobile security, Pradeo protects business mobile devices and applications. [Read More](https://www.pradeo.com/en-US/) - [Resources](https://www.pradeo.com/en-US/pradeo-ressources#white_papers) - [UEM security](https://www.pradeo.com/en-US/uem-mdm-security) - [Use cases](https://www.pradeo.com/en-US/pradeo-ressources#use-case) - [Data protection](https://www.pradeo.com/en-US/mobile-data-privacy-regulation) - [Contact us](https://www.pradeo.com/en-US/contact-us) - [Mobile Threat Defense](https://www.pradeo.com/en-US/mobile-threat-defense) - [Mobile Application Security Testing](https://www.pradeo.com/en-US/application-security-testing) - [In-App Protection](https://www.pradeo.com/en-US/in-app-protection) - [Secure Private Store](https://www.pradeo.com/en-US/private-app-store) - [Mobile Threat Intelligence](https://www.pradeo.com/en-US/mobile-threat-intelligence#perso-threat-intelligence) ![email.svg](https://cdn2.hubspot.net/hubfs/3067823/awwal/email.svg "email.svg") [contact@pradeo.com](mailto:contact@pradeo.com) Copyright @ 2022. All Right Reserved. - - - ```json { "@context" : "http://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Roxane Suau" }, "dateModified" : "September 24, 2025, 2:53:09 PM", "datePublished" : "2025-09-24 14:53:09", "description" : "Google patches 120 Android vulnerabilities, including 2 zero-days already exploited, showing why strong mobile security is essential.", "headline" : "September 2025: Google fixes 120 Android vulnerabilities, including 2 zero-days", "image" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/Template%20article.png" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://2378615.fs1.hubspotusercontent-eu1.net/hubfs/2378615/Logo%20Pradeo%20D%C3%A9grad%C3%A9%20Long%20Couleurs.svg" }, "name" : "Pradeo" } } ```