Android is the most used operating system in the world, running on billions of smartphones and tablets made by scores of companies including Google, Samsung, OnePlus, Oppo, Xiaomi, Honor, Nothing and Huawei.
Unfortunately this means these devices are very often targeted by criminals looking to exploit weaknesses in the software for financial gain, which is why Google, the maker of Android, makes sure to issue a monthly security bulletin to fix all existing bugs and make Android a safe OS.
While July 2025 was a rare month in which Google did not need to push out any security fixes whatsoever, normal service resumed for August, with the tech giant identifying and fixing six flaws in Android.
“The most severe of these issues is a critical security vulnerability in the System component that could lead to remote code execution in combination with other bugs, with no additional execution privileges needed,” Google said. “User interaction is not needed for exploitation.”
This means the bug is bad enough that it would be technically possible for someone to access an Android device remotely and without the expected security privileges.
As with most Android bug fixes, the likelihood of you actually falling foul of something like this is relatively rare, but experts recommend that you keep your Android devices as up to date as possible by installing security updates when they are available.
“While August’s Android Security Bulletin is lighter in volume compared to earlier this year, the criticality of the patched issues cannot be understated,” said Adam Boynton, Senior Security Strategy Manager EMEIA at security firm Jamf.
“Google’s bulletin calls for devices to be on patch level 2025‑08‑05 or newer to ensure full protection across all disclosed vulnerabilities.
“Perhaps most concerning is CVE‑2025‑48530, a critical system-level vulnerability allowing remote code execution without user interaction or elevated execution rights, particularly on Android 16. Though fewer in number, these flaws represent high-impact risks that require immediate action.”
Android 16 is the latest version of Android, and is only widely available on Google Pixel phones and some newer Samsung devices.
When it comes to security updates though, these can be pushed to phones and tablets whatever version of Android they run. But it is up to Android device makers to implement Google’s big fixes, so if you have a Samsung, OnePlus or other non-Google branded phone, you might be waiting a while to receive your free update.
It’s a security issue that has plagued Android for years, but things are improving. Google offers seven years of software updates for its Pixel phones, and Samsung offers six or seven for many of its Galaxy smartphones.
Other manufacturers are improving, but they are playing catch up. But once the updates are implemented by those Android makers, it’s up to you – or businesses that hand out Android devices – to press the update button.
“We urge organisations to ensure all managed Android devices are promptly updated to the 2025‑08‑05 security patch level (or newer) so they aren’t exposed,” Boynton said. “This month’s bulletin reinforces the principle that even smaller updates can close pathways used by skilled threat actors – staying ahead requires proactivity, not complacency.”