Google has released security patches for six total vulnerabilities in its Android August 2025 update including two for Qualcomm flaws that have been used in targeted attacks.
As reported by Bleeping Computer, both flaws were initially reported by Google's Android Security team in January 2025.
The first bug (tracked as CVE-2025-21479) is a weakness in the graphics framework that can lead to memory corruption because of an unauthorized command execution in the GPU microcode. Meanwhile, the second bug (tracked as CVE-2025-27038), is a use-after-free vulnerability which also causes memory issues, this time while rendering graphics using Adreno GPU drivers in Chrome.
In June, Google integrated the patches Qualcomm had announced. That same month, Qualcomm also stated that there had been evidence from Google’s Threat Analysis Group that the two security bugs had been exploited in targeted attacks.
In the same announcement, the company said that the patches for its Adreno GPU had been made available to OEMs in May and strongly recommended that those companies deploy the update.
Additionally, these two security bugs were added to CISA’s catalog as well, making it on the list of actively exploited vulnerabilities on June 3rd. CISA ordered federal agencies to update and secure their devices by June 24th.
Other updates in the Android August 2025 security update include a security vulnerability in the System component that attackers, even those without the necessary privileges, can use to achieve remote code execution when chained with other flaws but only in attacks that don’t require user interaction.
The two sets of security patches that have been issued are 8/1/2025 and 8/5/2025; as usual, Pixel devices will immediately receive updates while other handsets will have theirs rolled out as the hardware manufacturers have time to test the updates against the hardware configurations.
Follow Tom's Guide on Google News to get our up-to-date news, how-tos, and reviews in your feeds. Make sure to click the Follow button.
