Full Report
Google has released security patches for six vulnerabilities in Android's August 2025 security update, including two Qualcomm flaws exploited in targeted attacks. [...]
Analysis Summary
# Vulnerability: Critical Qualcomm Vulnerabilities Patched in Android Updates
## CVE Details
- CVE ID: *(Not explicitly listed for the new August patches, but references CVE-2024-43047 regarding a previously patched Qualcomm zero-day exploited by Serbian authorities)*
- CVSS Score: *(Not provided for the specific August flaws, but the article mentions one flaw in the System component that allows RCE)*
- CWE: *(Not provided)*
## Affected Systems
- Products: Android OS (System component), Qualcomm components.
- Versions: Devices receiving the August 2025 Android security updates (2025-08-01 and 2025-08-05 security patch levels).
- Configurations: Any Android device relying on the affected Qualcomm components or system libraries.
## Vulnerability Description
Google has issued patches for critical security vulnerabilities affecting Qualcomm components and a critical flaw in the Android System component. The System component vulnerability allows attackers with no privileges to potentially achieve Remote Code Execution (RCE) when chained with other vulnerabilities in attacks that require no user interaction. This follows previous patching efforts for zero-days exploited in targeted attacks, such as CVE-2024-43047, linked to NoviSpy spyware.
## Exploitation
- Status: **Exploited in the wild** (Mentioned for *previous* related Qualcomm flaws, and the context implies the newly patched flaws may also be under active threat or exploitation, especially considering the US order). The previous Qualcomm zero-day (CVE-2024-43047) was used in targeted attacks.
- Complexity: Likely **Low** for the System component RCE when chained, as it requires no user interaction.
- Attack Vector: **Network** (for unauthenticated remote code execution potential).
## Impact
- Confidentiality: [High - due to RCE capability]
- Integrity: [High - due to RCE capability]
- Availability: [High - due to RCE capability leading to system compromise]
## Remediation
### Patches
- Android 2025-08-01 Security Patch Level (Includes system component fixes).
- Android 2025-08-05 Security Patch Level (Bundles all prior fixes plus updates for closed-source third-party and kernel subcomponents).
### Workarounds
- Specific workarounds are not detailed, but immediate patching is strongly recommended given the potential for unauthenticated remote code execution.
## Detection
- Detection methods are not detailed in the provided context.
- Indicators of compromise would likely involve unusual activity stemming from the memory corruption or code execution in the affected components. System/Kernel logs should be monitored for anomalies, especially post-patch application.
## References
- Vendor Advisories: Android Security Bulletin components related to 2025-08-01 and 2025-08-05 (Source unavailable at `source.android.com/docs/security/bulletin/2025-08-01`).
- Other Links:
- Previous fix regarding CVE-2024-43047: `bleepingcomputer.com/news/security/google-fixes-two-android-zero-days-used-in-targeted-attacks/`
- Previous Qualcomm zero-day report: `bleepingcomputer.com/news/security/qualcomm-patches-high-severity-zero-day-exploited-in-attacks/`