What the June Android security update is and why it matters
The June Android security update is a large collection of software fixes that correct dangerous flaws in the Android operating system, closing holes that attackers can use to take control of phones, steal data, or run malicious code without the user’s knowledge or consent. In this Android security update June bulletin, Google shipped fixes for 124 vulnerabilities across Android 14, 15, 16, and 16 QPR2, making it one of the biggest security bulletin fixes of the year. Eighteen of these flaws are rated Critical, affecting the Framework, System, Kernel, and key chipset components from Qualcomm and others. One high‑severity framework bug, tracked as CVE-2025-48595, is already under limited, targeted exploitation in the wild. This means attackers are using it against real devices, which makes installing the patches a higher priority than a routine update.
The critical Android vulnerability already under attack
The headline issue in this Android security update June is CVE-2025-48595, a high-severity integer overflow in the Android Framework with a CVSS score of 8.4. According to Google’s June Android Security Bulletin, there are “indications that CVE-2025-48595 may be under limited, targeted exploitation.” The flaw stems from arithmetic operations without proper bounds checking, which can cause an integer value to wrap around and be reused as an incorrect buffer size or memory index. In practice, a malicious app with basic permissions could exploit this to execute code with elevated privileges, gaining broad control of the device without requesting more permissions or further user interaction. This critical Android vulnerability is especially dangerous when chained with other fixes in the bulletin, such as remote code execution bugs in the Media Framework or Bluetooth, turning a single device compromise into a powerful attack.
Who gets the Android patch first—and who waits
As usual, Android patch rollout depends heavily on which phone you own. Pixel devices receive the June Android security update on day one, with the fixes delivered via security patch levels 2026-06-01 and 2026-06-05. The latter level includes all June security bulletin fixes plus extra patches for kernel and chipset components, including Qualcomm closed-source drivers such as CVE-2025-47392 and CVE-2026-25276. Non-Pixel phones from brands like Samsung, OnePlus, Motorola, and Xiaomi must wait for their manufacturers to integrate and ship the update. That delay can range from a few days for current flagships to weeks—or never—for older or budget models. Some protections may arrive earlier through Google Play System Updates (Project Mainline), which silently update certain components from the Play Store, but full protection from CVE-2025-48595 requires the proper June firmware patch level.
How to check if your phone is protected
To confirm whether the June Android security update is installed, open Settings, go to About phone, then Android version (on many devices), or Security & privacy > System and updates on Pixel. Look for the Android security patch level: you want to see either 2026-06-01 or 2026-06-05 listed. If your phone shows an earlier date, trigger a manual Android patch rollout check. On Pixel, that’s Settings > System > Software updates > System update > Check for update. On Samsung, go to Settings > System updates > Check for system updates. For OnePlus, use Settings > System & update > System update. Also check your Google Play system update under Security & privacy > System and updates, since some Mainline components update separately. If no update appears yet, repeat the check daily and avoid installing unfamiliar apps in the meantime.
What to do now—and how to stay safer while you wait
Until your device shows the June security patch level, you should treat CVE-2025-48595 and related flaws as open doors. Install the update as soon as it appears, and do not postpone it. While you wait, reduce your exposure: avoid sideloading APKs, remove unused or suspicious apps, and stick to the official Play Store. Disable Bluetooth when not in use to limit risk from issues like the high‑severity Bluetooth heap overflow (CVE-2026-0059) fixed in this bulletin. Review app permissions and revoke any that seem unnecessary, especially for apps you do not fully trust. When your phone receives either the 2026-06-01 or 2026-06-05 patch level, reopen Settings and confirm the install completed. This June release is one of the largest Android security bulletin fixes this year, and treating it as a must‑install update is the safest choice.
