Hi everyone,
Google has just released its April 2025 Android Security Bulletin, patching 62 vulnerabilities, including two critical zero-day flaws that were already being actively exploited.
What is a zero-day? It’s a security bug with no fix available at the time it's discovered or exploited—giving attackers a dangerous head start. That’s why staying updated is so important.
Who gets the update?
The patches apply to Android 13, 14, and 15. While Android vendors are notified about these issues a month before public release, updates may not reach all devices right away.
To check if your phone is up to date:
- Go to Settings
- Look under About phone or About device
- Tap Software updates to see if an update is available
If your phone shows a security patch level of 2025-04-05 or later, you’re covered. This level includes all the fixes from 2025-04-01 plus additional patches for kernel and third-party components. Not every device needs every patch, but the higher level is more complete.
Why this matters
Among the 62 issues fixed, two stand out as especially dangerous. These vulnerabilities exist in the Linux kernel’s USB audio component and can be exploited without any user interaction:
- CVE-2024-53150: An out-of-bounds flaw in the USB-audio driver that can lead to information disclosure. It was caused by a failure to properly check data lengths. It may allow local attackers to access sensitive information on the device.
- CVE-2024-53197: A privilege escalation vulnerability that, when chained with other exploits, was reportedly used in Serbia by law enforcement to access a student activist’s phone using Cellebrite tools.
We don’t yet know the full scope of the exploitation, but the fact that these zero-days were seen in real-world attacks is a good reminder to keep your device up to date.
What you can do
- Check your update settings
- Apply security patches as soon as they’re available
- Stay informed and aware of zero-day risks
As always, feel free to share any questions or insights below!
Stay safe,
— The Trend Micro Community Team
