Google this week rolled out fixes for a total of 111 unique CVEs as part of the September 2025 set of Android patches, including exploited zero-days. The exploited vulnerabilities, both privilege escalation issues, impact the Android Runtime (CVE-2025-48543) and Linux kernel (CVE-2025-38352). “There are indications that the following may be under limited, targeted exploitation: CVE-2025-38352, CVE-2025-48543,” Google’s advisory reads. Fixes for the Linux kernel bug, a race condition related to the handling of POSIX CPU timers, were announced in July, and all major distributions appear to have been patched. While there are no reports of the vulnerability’s exploitation prior to Google’s fresh warning, it was reported by Benoît Sevens of Google’s Threat Analysis Group (TAG), which suggests…