Google has released its June 2026 Android security update, addressing 124 vulnerabilities, including one actively exploited zero-day. The zero-day — CVE-2025-48595 — is an integer overflow vulnerability in the Android Framework that allows local attackers to escalate privileges on affected devices without requiring user interaction. CVE-2025-48595 is classified as a high-severity integer overflow (CWE-190) in the Android Framework — the set of APIs and system services that applications interact with directly. An integer overflow occurs when an arithmetic operation produces a value that exceeds the maximum size of the data type used to store it, causing the value to wrap around or produce unexpected behaviour that attackers can exploit to gain elevated access.

CVE-2025-48595: The Zero-Day Under Fire

The vulnerability enables a local attacker with basic application permissions to escalate privileges and execute code at a higher permission level, potentially gaining full control of device functions. Crucially, exploitation requires no user interaction beyond running a malicious application on the device. This marks the fourth Android zero-day patched since December 2025. Google noted that CVE-2025-48595 "may be under limited, targeted exploitation" — language the company uses when targeted attacks have been confirmed, but widespread in-the-wild exploitation has not yet been observed. This pattern is frequently associated with commercial spyware vendors or nation-state threat actors targeting high-profile individuals such as journalists, activists, or government officials.

Scope of the June 2026 Update

The June 2026 Android security update is substantial, fixing 124 vulnerabilities across two patch levels. Patch level 2026-06-01 addresses core Android OS components, including the Framework and System, with 18 vulnerabilities rated critical. **Patch level 2026-06-05** includes all fixes from 2026-06-01 plus additional patches for kernel subcomponents and third-party chipset drivers from manufacturers such as Qualcomm and MediaTek. Affected Android versions include Android 14, 15, 16, and Android 16 QPR2. Pixel devices receive updates immediately through Google's update delivery system, while devices from Samsung, OnePlus, Xiaomi, and other manufacturers will receive updates on a rolling timeline that may extend weeks or months after Google's release.

CVSS and Technical Details

• CVE: CVE-2025-48595
• CWE: CWE-190 (Integer Overflow or Wraparound)
• Severity: High
• KEV Status: Not confirmed, added to CISA KEV catalogue as of June 3, 2026
• Affected Versions: Android 14, Android 15, Android 16, Android 16 QPR2

Why It Matters

The pattern of four Android zero-days in under six months reflects an active market for Android exploits among sophisticated threat actors. While Google's characterisation of "limited, targeted exploitation" suggests this is not yet a mass exploitation scenario, targeted use by spyware operators or nation-state actors presents significant risk for high-value individuals and organisations. Mobile devices increasingly serve as primary work devices, accessing corporate email, VPN, and sensitive business applications. A privilege escalation vulnerability on a corporate-enrolled Android device could allow an attacker to capture credentials, intercept MFA codes, access enterprise apps, and exfiltrate sensitive data — all from a device users typically trust implicitly. The trajectory of Android zero-days in 2026 suggests that mobile endpoints are receiving increased attention from sophisticated threat actors," said a threat intelligence analyst. "Organisations with mobile device management (MDM) programmes should treat Android OS updates with the same urgency as Windows Patch Tuesday releases."

Mitigation Steps

• Apply the June 2026 Android security update immediately on all managed Android devices via your MDM or enterprise mobility management (EMM) platform.
• For Pixel devices, install the update via Settings > System > Software update.
• Contact device manufacturers for updated timelines if using non-Pixel Android devices.
• Implement mobile application management (MAM) policies that block installation of applications from unverified sources.
• Enable Google Play Protect scanning on all managed Android devices.
• Restrict sensitive corporate applications to devices meeting a minimum patch level of 2026-06-05 through MDM policy enforcement.
• Monitor for unusual privilege escalation events in your mobile device management console.

Google's June 2026 Android update demonstrates that mobile patch management is now an essential component of enterprise security hygiene, not an optional maintenance activity.

Google has shared new details on how its Gemini ad safety systems are being used to detect and block harmful ads, as online scams continue to grow in scale and complexity. The update points to a sharp rise in malicious advertising activity, with billions of ads removed and millions of advertiser accounts suspended over the past year. The company said its systems blocked more than 8.3 billion ads in 2025, with a large portion linked to scam activity. Nearly 25 million advertiser accounts were also suspended, including millions tied to fraudulent campaigns. The figures highlight the volume of abuse facing large ad platforms and the ongoing challenge of keeping such content in check. [caption id="attachment_111449" align="aligncenter" width="700"] Image Source: Google[/caption]

Gemini Ad Safety Focuses on Early Detection

A key shift in Gemini ad safety is the focus on stopping harmful ads before they are published. Instead of relying only on keyword-based filters, newer systems are designed to assess intent by analyzing a wide range of signals such as account behavior, campaign patterns, and account history. This approach reflects a broader move across the industry toward earlier detection. By identifying suspicious activity at the submission stage, platforms aim to reduce the number of harmful ads that reach users in the first place. Google said its systems now catch more than 99 percent of policy-violating ads before they are served, although such figures are difficult to independently verify.

Rise of AI-Generated Scam Ads Adds Pressure

The update comes as scammers increasingly use generative AI to create more convincing fake ads. These ads can mimic legitimate businesses, use polished language, and adapt quickly, making them harder to detect using older systems. This shift has put pressure on ad platforms to respond faster. Under the Gemini ad safety framework, many ads are now reviewed instantly at the time they are submitted. This includes Responsive Search Ads, where harmful content can be blocked before going live. At the same time, user reports continue to play a role. Google said it processed significantly more user complaints in 2025 compared to the previous year, allowing faster action when suspicious ads slip through.

Policy Enforcement and Verification Measures Expand

Alongside automated detection, enforcement still relies on Google Ads policies, which define what content and practices are allowed. These rules prohibit areas such as counterfeit goods, dangerous products, and services that enable dishonest behavior, including hacking tools or fake documents. Advertiser verification is another part of the system. By requiring identity checks, platforms attempt to prevent repeat offenders from re-entering under new accounts. While verification can limit abuse, it also depends on how strictly it is enforced and how easily it can be bypassed. The combination of policy enforcement and AI-based detection forms the backbone of the current Gemini ad safety approach.

Accuracy Improves, but Challenges Remain

One issue in ad moderation is the risk of false positives, where legitimate advertisers are flagged or suspended. Google said improvements in its models have reduced incorrect suspensions, suggesting better differentiation between genuine campaigns and misleading ones. Even so, the scale of enforcement raises ongoing questions. Blocking billions of ads indicates both improved detection and the sheer volume of problematic content being submitted. The use of AI on both sides is also shaping the landscape. While platforms use tools like Gemini ad safety to detect abuse, attackers are using similar technologies to create it. This creates a continuous cycle where detection methods need to keep evolving.

Ongoing Effort to Contain Malicious Advertising

The latest figures underline how widespread malicious advertising has become. Scam ads remain a persistent issue, particularly in sectors where users are more likely to engage with offers or financial services. Google’s update suggests progress in identifying and removing harmful content earlier in the process. However, the data also shows that ad platforms are dealing with a high and steady flow of abuse attempts. As Gemini ad safety systems continue to develop, the focus is likely to remain on faster detection, stronger verification, and tighter enforcement. For users, the impact depends on how effectively these measures reduce exposure to scam ads over time.