Critical Android 0-Click Vulnerability in System Component Allows Remote Code Execution Attacks

Google has issued a critical security alert for Android devices, highlighting a severe zero-click vulnerability in the system’s core components that could allow attackers to execute malicious code remotely without any user interaction.

Disclosed in the November 2025 Android Security Bulletin, this flaw affects multiple versions of the Android Open Source Project (AOSP) and underscores the ongoing risks in mobile operating systems.

As smartphones handle sensitive data like banking credentials and personal communications, such vulnerabilities pose significant threats to millions of users worldwide.

The primary concern revolves around CVE-2025-48593, a remote code execution (RCE) bug discovered in the System component. This vulnerability requires no additional privileges or user engagement, making it particularly dangerous.

Attackers could potentially exploit it via crafted network packets or malicious apps distributed through sideloads or third-party stores.

Google classified it as critical due to its potential for full device compromise, including data theft, ransomware deployment, or even turning the phone into a botnet node. The issue was reported internally via Android bug ID A-374746961 and patched in AOSP versions 13 through 16.

Vulnerability Breakdown and Affected Systems

This zero-click exploit stems from improper handling of system-level processes, allowing arbitrary code injection during routine operations like app launches or background syncing.

Security researchers note that while the exact root cause remains under wraps to prevent widespread abuse, it aligns with past Android flaws where memory corruption enabled privilege escalation.

Devices running Android 10 and later are eligible for updates, but older versions may remain exposed if manufacturers lag in deployment.

In addition to the critical RCE, the bulletin addresses CVE-2025-48581, a high-severity elevation of privilege (EoP) vulnerability in the same System component. This could let malicious apps gain unauthorized access to sensitive features, though it requires some initial foothold.

CVE ID	References	Type	Severity	Updated AOSP Versions
CVE-2025-48593	A-374746961	RCE	Critical	13, 14, 15, 16
CVE-2025-48581	A-428945391	EoP	High	16

To protect against these threats, users should immediately check for system updates via Settings > System > System Update. Google recommends applying the 2025-11-01 security patch level, which fully resolves these issues for supported devices.

Manufacturers like Samsung, Pixel, and others must roll out patches promptly, as delays could leave billions vulnerable.

This bulletin arrives amid rising mobile threats, including state-sponsored spyware targeting activists. No active exploits have been reported yet, but the zero-click nature amplifies risks for high-profile targets.

Android’s modular update system via Google Play helps, but fragmentation remains a challenge. Experts urge enabling auto-updates and avoiding untrusted apps to stay secure in an increasingly hostile digital landscape.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.