Google has launched its month-to-month security updates for Android with fixes for 46 security flaws, together with one vulnerability that it mentioned has been exploited within the wild.
The vulnerability in query is CVE-2025-27363 (CVSS rating: 8.1), a high-severity flaw within the System element that might result in native code execution with out requiring any extra execution privileges.
“Probably the most extreme of those points is a excessive security vulnerability within the System element that might result in native code execution with no extra execution privileges wanted,” Google mentioned in a Monday advisory. “Consumer interplay isn’t wanted for exploitation.”
It is price noting that CVE-2025-27363 is rooted within the FreeType open-source font rendering library. It was first disclosed by Fb in March 2025 as having been exploited within the wild.
The shortcoming has been described as an out-of-bounds write flaw that might end in code execution when parsing TrueType GX and variable font information. The difficulty has been remediated in FreeType variations greater than 2.13.0.
“There are indications that CVE-2025-27363 could also be beneath restricted, focused exploitation,” Google acknowledged in its security bulletin. The precise specifics of the assaults are presently unknown.
Google’s Could replace additionally resolves eight different flaws within the Android System and 15 flaws within the Framework module that could possibly be abused to facilitate privilege escalation, data disclosure, and denial-of-service.
“Exploitation for a lot of points on Android is made tougher by enhancements in newer variations of the Android platform,” the corporate mentioned. “We encourage all customers to replace to the most recent model of Android the place attainable.”
