Google has released an urgent security patch addressing significant vulnerabilities affecting Android smartphones, following a warning about active exploitation of these flaws. The vulnerabilities, identified by Qualcomm, were publicly disclosed in June 2025, with implications for numerous devices running on the Android operating system.
Critical Vulnerabilities Identified
Qualcomm reported three vulnerabilities, designated as CVE-2025-21479, CVE-2025-21480, and CVE-2025-27038, which were linked to its Adreno Graphics Processing Unit (GPU) driver. The company indicated that these flaws posed risks of “limited, targeted exploitation,” raising concerns about potential state-sponsored attacks aimed at high-value targets, including diplomats, journalists, and scientists. The Google Threat Analysis Group (TAG) flagged these vulnerabilities, underscoring their seriousness.
In May 2025, Qualcomm urged original equipment manufacturers (OEMs) to implement patches to safeguard users. According to Qualcomm, “Patches for the issues affecting the Adreno GPU driver have been made available to OEMs in May together with a strong recommendation to deploy the update on affected devices as soon as possible.”
Google’s Response and Patch Details
In response, Google released its August 2025 update for Android, which includes fixes for two of the identified vulnerabilities: CVE-2025-21479 and CVE-2025-27038. The former vulnerability involves “memory corruption due to unauthorized command execution in GPU micronode while executing a specific sequence of commands,” and has been assigned a severity score of 8.6/10 (high). The latter involves memory corruption during graphics rendering using Adreno GPU drivers in Chrome, with a severity score of 7.5/10 (high).
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on June 3, 2025. This action mandated that Federal Civilian Executive Branch (FCEB) organizations address these issues within three weeks, either by applying the patches or ceasing use of the vulnerable software entirely.
Given the decentralized nature of Android, the rollout of these updates may vary across devices. For instance, devices from manufacturers such as Samsung and OnePlus will likely receive updates at different times. Google’s own Pixel devices are expected to receive the updates first, ensuring that those users can quickly address the security risks.
In light of these developments, users are encouraged to check for updates and apply them promptly to protect their devices from potential threats. Maintaining software security is essential to safeguarding personal information and ensuring safe usage of mobile technology.
