Google patches 107 Android flaws, including two being actively exploited

Malwarebytes highlights Google’s December 2025 Android Security Bulletin which patches 107 vulnerabilities and calls out two framework-level flaws under limited, targeted active exploitation (CVE-2025-48633 — likely information disclosure — and CVE-2025-48572 — CVSS 7.4, allows local arbitrary code execution). Users are advised to install updates (patch level 2025-12-05 or later), avoid installing untrusted apps, scrutinize permissions, and use up-to-date mobile security software.