Google has released the August security updates for Android, which contain patches for six vulnerabilities. Two of these are related to Qualcomm components and have already been exploited in targeted attacks. The vulnerabilities under attack have been identified with the identifiers CVE-2025-21479 and CVE-2025-27038, and the Android security team became aware of them as early as January 2025.
The first issue (CVE-2025-21479) is related to incorrect authorization in the graphics framework, which can cause Memory corruption due to the execution of unauthorized commands in the GPU micromodule based on a certain command sequence.
The second issue (CVE-2025-27038) is a use-after-free bug that causes memory corruption when using Adreno GPU drivers for rendering in Chrome.
It’s important to note that Google included the patches announced by Qualcomm in the update back in June of this year. At the time, the manufacturer warned that, according to information from the Google Threat Analysis Group, the vulnerabilities CVE-2025-21479, CVE-2025-21480, and CVE-2025-27038 could be exploited “in limited targeted attacks.”
“In May, OEM partners were provided with fixes for issues affecting the Adreno graphics processing unit (GPU) driver, along with a strong recommendation to deploy the update to affected devices as soon as possible,” Qualcomm said at the time.
Additionally, with the August update release, Google fixed a critical vulnerability in the system component (CVE-2025-48530). This issue could be exploited for unprivileged remote code execution, but only when combined with other bugs. No user interaction was required.
Traditionally, Google developers released two update levels: 2025-08-01 and 2025-08-05. The latter includes all the patches from the former, plus fixes for closed-source components and kernel subsystems that may not apply to all Android devices.
Follow us on Google News to receive daily updates on cybersecurity. Contact us if you would like to report news, insights or content for publication.
