Vendor
Android: actively exploited vulnerabilities
17 vulnerabilities in Android products are listed in CISA’s catalog of actively exploited vulnerabilities. Latest addition on June 2, 2026: CVE-2025-48595 (Framework).
- 17 exploited vulnerabilities in the catalog
- 3 added in the last 12 months
- 0 used by ransomware
- 6 products affected
Affected products
- Framework6
- Pixel4
- Kernel3
- Android Kernel2
- Android OS1
- Runtime1
CERT-FR alerts and notices
Recent CERT-FR publications naming this vendor (alerts: immediate threat; notices: patches released). In French.
-
CERTFR-2026-AVI-1265Multiples vulnérabilités dans Google Android (06 octobre 2026)
All exploited vulnerabilities
CISA KEV catalog, newest first: each entry corresponds to observed exploitation.
2026 1 vulnerability
-
CVE-2025-48595Android Framework Integer Overflow Vulnerability
2025 3 vulnerabilities
-
CVE-2025-48633Android Framework Information Disclosure Vulnerability
-
CVE-2025-48572Android Framework Privilege Escalation Vulnerability
-
CVE-2025-48543Android Runtime Use-After-Free Vulnerability
2024 6 vulnerabilities
-
CVE-2024-43093Android Framework Privilege Escalation Vulnerability
-
CVE-2024-36971Android Kernel Remote Code Execution Vulnerability
-
CVE-2024-32896Android Pixel Privilege Escalation Vulnerability
-
CVE-2024-29748Android Pixel Privilege Escalation Vulnerability
-
CVE-2024-29745Android Pixel Information Disclosure Vulnerability
-
CVE-2023-21237Android Pixel Information Disclosure Vulnerability
2023 2 vulnerabilities
-
CVE-2023-35674Android Framework Privilege Escalation Vulnerability
-
CVE-2023-20963Android Framework Privilege Escalation Vulnerability
2022 3 vulnerabilities
-
CVE-2011-1823Android OS Privilege Escalation Vulnerability
-
CVE-2021-1048Android Kernel Use-After-Free Vulnerability
-
CVE-2021-0920Android Kernel Race Condition Vulnerability
2021 2 vulnerabilities
-
CVE-2020-0041Android Kernel Out-of-Bounds Write Vulnerability
-
CVE-2019-2215Android Kernel Use-After-Free Vulnerability
What to do
If your estate includes any of these products, make sure the vendor’s patches are applied, starting with the most recent vulnerabilities and those used by ransomware, then look for signs of compromise: an exploited vulnerability has often been used before it was fixed.
Additions from all vendors are tracked on the Actively exploited vulnerabilities page, updated several times a day. Sources: CISA KEV catalog (US public domain) and CERT-FR.