The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two Android Framework vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, signaling that both flaws are being used in real-world attacks and should be prioritized by defenders. The entries, CVE-2025-48572 and CVE-2025-48633, correspond to elevation-of-privilege and information-disclosure bugs in the Android Framework component.
Both issues were previously highlighted in Google’s December 2025 Android Security Bulletin, which documented 100-plus vulnerabilities affecting Android 13 through 16, including the two Framework bugs that Google said showed signs of limited, targeted exploitation in the wild. Security research summaries describe CVE-2025-48572 as a local privilege-escalation flaw that can allow a malicious application to execute code with elevated permissions, and CVE-2025-48633 as an information-disclosure issue that can expose data across privilege boundaries.
A separate advisory from the Canadian Centre for Cyber Security confirms that CISA added both CVEs to the KEV database on December 2, 2025, shortly after the Android bulletin was released. The advisory reiterates that organizations should urgently apply the December 2025 Android patches and notes that KEV inclusion reflects evidence of active exploitation.
Additional reporting indicates that CISA is requiring U.S. federal civilian executive branch agencies to remediate the vulnerabilities by December 23, 2025, under Binding Operational Directive 22-01. That directive obliges agencies to address KEV-listed flaws within prescribed timelines or implement documented mitigations, and CISA encourages critical infrastructure operators and private-sector organizations to treat the catalog as a de-facto patch priority list.
The KEV additions underscore the risk posed by mobile endpoints and bring-your-own-device (BYOD) fleets. The affected Framework component underpins high-level Android APIs used by applications, making successful exploitation a potential pathway to broader device compromise when combined with other vulnerabilities. Security advisories from multiple vendors stress the importance of enforcing Android patch levels of at least 2025-12-05 for corporate-managed devices, monitoring for installation of untrusted apps, and reviewing mobile threat-defense coverage for Android estates.
Sources: Security Affairs, Canadian Centre for Cyber Security, The Hacker News, SOCRadar, Cybersecurity News
—
By Cass Kennedy
