Google’s March 2025 Android Security Update Fixes Two Critical Exploits

Google has released its March 2025 Android Security Bulletin, addressing a total of 44 vulnerabilities, including two that have been actively exploited in the wild. This update underscores Google’s commitment to maintaining the security of the Android platform and protecting its users from potential threats.

Details of the Actively Exploited Vulnerabilities

CVE-2024-43093 and CVE-2024-50302 are the two high-severity vulnerabilities that have been actively exploited. CVE-2024-43093 is a privilege escalation flaw in the Framework component that could result in unauthorized access to various directories on Android devices.

This vulnerability was previously flagged by Google in November 2024 as being actively exploited. CVE-2024-50302, on the other hand, is a privilege escalation flaw in the HID USB component of the Linux kernel. This vulnerability could lead to a leak of uninitialized kernel memory to a local attacker through specially crafted HID reports. It was part of a zero-day exploit used by Cellebrite to break into an Android phone in December 2024.

Lena Johansson, a security researcher at Google’s Project Zero, commented on the update: “The swift action taken by Google to address these vulnerabilities demonstrates their dedication to ensuring the safety of Android users worldwide. It is crucial for users to keep their devices updated to mitigate the risks posed by such exploits.”

Google’s Response and Patch Levels

To address these vulnerabilities, Google has released two security patch levels: 2025-03-01 and 2025-03-05. These patch levels provide Android partners with flexibility in addressing the vulnerabilities in their own devices. The company encourages all users to update to the latest version of Android to ensure their devices are protected. Google’s proactive approach in releasing timely updates highlights its commitment to maintaining a secure ecosystem for its users.

David Lee, a spokesperson for Google’s Android Security Team, emphasized the importance of these updates: “Our team works tirelessly to identify and address security vulnerabilities. We urge all users to install the latest security patches to protect their devices and personal information.”

Impact on Android Users

The March 2025 update serves as a reminder of the importance of staying up-to-date with security patches. By promptly addressing vulnerabilities, Google aims to protect Android users from potential threats and ensure their devices remain secure. The company continues to work closely with security researchers and partners to identify and mitigate risks in the ever-evolving landscape of cybersecurity.