Google Android Framework Integer Overflow LPE Exploited (CVE-2025-48595) | MSSP Advisory

Risk Assessment

Google's June 2026 Android security update patches 124 vulnerabilities across Android 14, 15, 16, and 16 QPR2, with CVE-2025-48595 confirmed under active exploitation. The flaw is a privilege escalation via integer overflow in the Android Framework component that requires zero user interaction and no elevated privileges to trigger, meaning an attacker can execute code on a target device silently. Google has acknowledged limited targeted exploitation, and the attack pattern matches commercial spyware deployment against specific individuals.

Your technicians and client-side staff carry Android devices that authenticate into your RMM, PSA, and remote access platforms daily, and a zero-interaction privilege escalation on those devices is a direct path into your management stack without touching a single firewall rule. On the client side, any client employee running an unpatched Android device on corporate Wi-Fi or accessing company email and MFA apps is carrying a device that can be silently compromised, and if you have not told them that, you own that silence. The commercial spyware angle means this is not random spray-and-pray, it is targeted, which makes your higher-value clients and your own staff the realistic surface.