Threat reportVulnerabilityTL-2026-0655
Android Framework Integer-Overflow Elevation-of-Privilege 0-Day (CVE-2025-48595) Under Limited Targeted Exploitation — June 2026 Android Security Bulletin
Android Framework Integer-Overflow Elevation-of-Privilege (TL-2026-0655), also tracked as Android Framework June 2026 EoP 0-Day, is a high-severity software vulnerability scored CVSS 8.4, first published 2026-06-02. It has no confirmed attribution, affects Google Android (Framework component), references 1 CVE (CVE-2025-48595), maps to 13 MITRE ATT&CK techniques (T1005, T1041, T1068), and is covered by 9 detection rules and 13 indicators of compromise.
- CVSS
- 8.4/10High
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 13MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-0655
- Threat ID
- TL-2026-0655
- Also known as
- Android Framework June 2026 EoP 0-Day
- Severity
- HIGH
- CVSS
- 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- ESPIONAGE
- Target sectors
- government, media, civil society, technology, telecommunications
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
How Android Framework Integer-Overflow Elevation-of-Privilege works
CVE-2025-48595 is a high-severity elevation-of-privilege flaw in the Android Framework caused by integer overflows in multiple code paths (CWE-190), allowing local privilege escalation with no additional execution privileges and no user interaction. Google states there are indications it may be under limited, targeted exploitation and addressed it in the June 2026 Android Security Bulletin (patch level 2026-06-01). It affects Android 14, 15, 16, and 16-QPR2 and is the kind of EoP primitive typically chained behind a remote initial-access exploit to achieve full device compromise.
CVE-2025-48595 is a high-severity elevation-of-privilege (EoP) vulnerability in the Android Framework layer, disclosed in the June 2026 Android Security Bulletin and assigned the highest-severity Framework rating for that bulletin. NVD describes the root cause as an integer overflow (CWE-190): 'In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed.' The CVSS v3.1 base score is 8.4 (HIGH) with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Exception to common reporting: although several trade outlets described the flaw as 'zero-click' and exploitable 'remotely,' the authoritative CVSS attack vector is Local (AV:L). The accurate reading is that CVE-2025-48595 is a local EoP primitive requiring no privileges (PR:N) and no user interaction (UI:N) — i.e., once an attacker has any low-privileged code-execution foothold on the device, this bug elevates them to higher (framework/system-context) privileges without further interaction. In real campaigns such a primitive is chained behind a separate remote initial-access exploit (for example a browser/renderer or messaging-client RCE delivered drive-by or zero-click), which is why the end-to-end chain is reported as remote and zero-click even though this specific CVE is a local privilege escalation. The integer overflow occurs in multiple locations within the Framework, meaning more than one reachable code path can trigger the unsafe arithmetic that leads to memory corruption and subsequent code execution in a higher-privileged context.
Integer-overflow EoP bugs in the Android Framework are valuable to advanced adversaries because the Framework (system_server and related system-context services exposed over Binder IPC) runs with elevated privileges and is reachable from unprivileged application sandboxes. An attacker app or compromised process supplies a crafted value (size/length/index) to an affected Framework code path; the value overflows during arithmetic (e.g., buffer-size or allocation calculation), producing an undersized allocation or out-of-bounds index that the attacker then leverages for controlled memory corruption and code execution at the privilege level of the Framework component. Because the bug needs 'no additional execution privileges,' it does not require any special permission grant, dangerous permission, or user consent dialog — a key property that makes it attractive for stealthy, fully-chained exploitation.
Google's bulletin notes: 'There are indications that CVE-2025-48595 may be under limited, targeted exploitation.' This phrasing is consistent with use by a well-resourced actor against specific targets rather than broad commodity abuse — the historical pattern for Android Framework/kernel 0-days is exploitation by commercial spyware vendors and nation-state operators for surveillance (audio/video/screen capture, message and credential theft, location tracking, and persistent access). No threat-actor attribution, malware family, hashes, domains, or IP IOCs were disclosed in the bulletin or the initial trade reporting; attribution is therefore Unknown with no public network/file indicators available for this CVE at time of analysis.
The issue is fixed at security patch level 2026-06-01 (the bulletin spans the 2026-06-01 and 2026-06-05 patch dates), with AOSP source patches expected to land in the Android Open Source Project repository shortly after publication. Google notifies Android partners of all bulletin issues at least a month before public disclosure, giving OEMs lead time to integrate fixes. Google Play Protect, enabled by default on devices with Google Mobile Services, provides partial mitigation by monitoring for and warning about potentially harmful applications, and is especially important for users who sideload apps from outside Google Play. Definitive remediation is applying a device security patch level of 2026-06-01 or later.
MITRE ATT&CK techniques used in TL-2026-0655
Collection
T1005 Data from Local System; T1113 Screen Capture; T1123 Audio Capture
Exfiltration
T1041 Exfiltration Over C2 Channel
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol
Discovery
T1082 System Information Discovery
Initial Access
Execution
T1203 Exploitation for Client Execution
Defense Evasion
T1211 Exploitation for Stealth
Credential Access
T1212 Exploitation for Credential Access
Persistence
T1543 Create or Modify System Process
Resource Development
Affected products and versions in Android Framework Integer-Overflow Elevation-of-Privilege
- Google — Android (Framework component)
Vulnerable versions: 14; 15; 16; 16-qpr2
Fixed in: Security patch level 2026-06-01 or later
Remediation for Android Framework Integer-Overflow Elevation-of-Privilege
Patches
- Android security patch level 2026-06-01 (June 2026 Android Security Bulletin).
- AOSP source patches published to the Android Open Source Project repository shortly after the bulletin.
- Corresponding OEM monthly security updates (e.g., Pixel, Samsung, Xiaomi June 2026 patches).
Immediate actions
- Update affected devices to Android security patch level 2026-06-01 or later (the June 2026 Android Security Bulletin fix for CVE-2025-48595).
- Confirm patch level under Settings > About phone > Android version > Android security update; prioritize high-risk and targeted users (executives, journalists, activists, government).
- Ensure Google Play Protect is enabled (default with Google Mobile Services) and avoid sideloading apps from outside Google Play.
Workarounds
- No vendor workaround exists; patching is the only definitive fix.
- Reduce attack surface by limiting installed apps, disabling sideloading, and keeping browsers/messaging clients updated to block the remote initial-access exploits this EoP is chained behind.
Longer-term hardening
- Enroll high-risk users in hardened modes (e.g., Android Advanced Protection / lockdown profiles) and enforce timely OEM security-patch SLAs via MDM.
- Deploy mobile threat defense (MTD) / EDR capable of detecting anomalous privilege transitions and abnormal Binder/system_server behavior.
- Enforce minimum-security-patch-level compliance policies in MDM and block enrollment of devices below the required patch baseline.
CVEs associated with Android Framework Integer-Overflow Elevation-of-Privilege
Weaknesses (CWE) in Android Framework Integer-Overflow Elevation-of-Privilege
Timeline of Android Framework Integer-Overflow Elevation-of-Privilege
- CVE-2025-48595 reserved with MITRE.
- Per Google policy, Android partners notified of all June 2026 bulletin issues at least a month before public disclosure (on/before this date).
- NVD publishes CVE-2025-48595 with CVSS v3.1 8.4 (HIGH, AV:L) and CWE-190 Integer Overflow root cause.
- Google states there are indications CVE-2025-48595 may be under limited, targeted exploitation.
- June 2026 Android Security Bulletin publicly discloses CVE-2025-48595 as a High-severity Framework EoP; fixed at security patch level 2026-06-01.
- Trade media (Cyber Security News, GBHackers) report active in-the-wild exploitation and full-device-compromise chaining; some describe the end-to-end chain as zero-click/remote.
- Second June 2026 bulletin security patch level (2026-06-05); AOSP source patches expected in the Android Open Source Project repository shortly after the bulletin.
Sources cited for Android Framework Integer-Overflow Elevation-of-Privilege
- Android Security Bulletin—June 2026
- NVD — CVE-2025-48595
- MITRE CVE — CVE-2025-48595
- Android 0-Day Vulnerability Exploited in Attacks to Gain Complete Device Control
- OffSeq Threat Radar — CVE-2025-48595 Elevation of Privilege in Google Android
- Android Security Update Addresses High-Severity Privilege Escalation Flaws
- CWE-190: Integer Overflow or Wraparound
- MITRE ATT&CK T1404 — Exploitation for Privilege Escalation (Mobile)
Detection coverage for TL-2026-0655
As of 2026-06-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0655 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.