Google’s newest Android Safety Bulletin patches 46 safety vulnerabilities impacting Android units, certainly one of which is a zero-day flaw in FreeType that could be underneath “restricted, focused exploitation.”
The safety replace for Could consists of fixes for a variety of points: most are an elevation of privilege flaws, although there are a number of data disclosure and denial of service vulnerabilities and one distant code execution bug. All are thought-about excessive severity. Could’s patch additionally addresses vulnerabilities with Qualcomm, MediaTek, Arm, and Creativeness Applied sciences parts.
One energetic exploit
The zero-day addressed with the newest replace is a distant code execution flaw labeled CVE-2025-27363. It impacts FreeType, an open-source font rendering library, and permits attackers to use how this system processes sure recordsdata. The bug impacts FreeType variations 2.13.0 and under and was first reported by safety researchers at Fb in March 2025, although particulars as to the way it has been exploited haven’t been disclosed.
What Android customers have to do
When you have an Android system, it’s best to get a notification to put in the newest safety replace as quickly because it’s out there. Google pushes patches to Pixel telephones and the core Android Open Supply Undertaking (AOSP) code, whereas different system producers—Samsung, Motorola, and Nokia—usually problem updates across the similar time.
What do you suppose up to now?
This month’s patches apply to AOSP variations 13, 14, and 15, with separate updates dated 2025-05-01 and 2025-05-05 (the latter addresses all the flaws recognized). Observe that Google ended assist for Android 12 as of March 31, that means units working this and older variations will not obtain safety updates despite the fact that they could be affected by a few of the vulnerabilities.
When you’re unsure whether or not your system has been patched, verify for out there updates by way of Settings > Safety & privateness > System & updates > Safety replace and comply with the prompts to obtain and set up.
