Google Pulled Seven Fixes From the December Android Bulletin

Google removed seven CVE IDs from the December 2025 Android Security Bulletin after the first fixes failed or threatened tap-to-pay. The live page still opens with a Critical Framework remote denial of service that is no longer in the tables.

The bulletin, published December 1, 2025 and last revised March 6, 2026, now lists 99 CVE IDs. Two Framework bugs that CISA logged as exploited never left the 2025-12-01 patch.

Seven CVE IDs Leave the Published Bulletin

Android partners get at least a month of notice before a bulletin goes public, and they are free to ship the code as soon as they have it. The public page is the later, legal act: it tells an OEM which flaws must be fixed before a device may show a given patch date.

That public list moved five times after launch. Each note says partners may keep the withdrawn code, then promises a replacement in a later bulletin.

THE DECEMBER REVISION LOG

1. December 1, 2025: Bulletin publishes as version 1.0.
2. December 4, 2025: Version 1.1 adds AOSP links.
3. December 17, 2025: CVE-2025-48600 and CVE-2025-48615 leave because the fix is incomplete.
4. January 8, 2026: CVE-2025-48631 leaves because the Android 16 25Q4 fix is incomplete; other Android versions are described as fine. A replacement is promised in ASB#2026-03.
5. February 10, 2026: CVE-2025-48612 (A-429417453) leaves because the fix may block switching default apps for contactless payments.
6. March 3, 2026: CVE-2025-48565 (A-407763772) leaves because the fix is incomplete.
7. March 6, 2026: CVE-2025-48566 and CVE-2025-48564 leave because they share that same incomplete fix.

The version table numbers both the January 8 and February 10 edits as 1.3. GrapheneOS, which ships Android patches under its own embargo schedule, had already watched the December set move before the public post. Its September 25, 2025 security preview for Android 16 carried 1 Critical and 54 High fixes, then took 5 more patches and retracted 1 in the days that followed.

In January 2026 the project put the problem in one line.

Android Security Bulletin dates are also misleading now.

GrapheneOS, @GrapheneOS, January 25, 2026

A phone that shows December 2025 as its patch date is declaring a string, not proving it received every fix that later replaced the seven IDs Google took off this page.

CISA Put Two Framework Bugs on a Deadline

The two December issues that never got pulled were the ones already in use. CISA added CVE-2025-48572 and CVE-2025-48633 to its Known Exploited Vulnerabilities catalog on December 2, 2025, citing evidence of active exploitation. Federal civilian executive branch agencies had until December 23, 2025, a 21-day clock under Binding Operational Directive 22-01.

THE TWO KEV ENTRIES

• CVE-2025-48572: Framework elevation of privilege, High, Android 13, 14, 15, and 16. The CVE record describes a permissions bypass that can launch activities from the background with no extra rights and no tap from the user.
• CVE-2025-48633: Framework information disclosure, High, same four Android versions. CISA’s catalog line calls it an unspecified Framework flaw that allows information disclosure.
• Patch home: Both sit on the 2025-12-01 level in the Framework table and were not among the seven IDs later removed.
• Agency deadline: December 23, 2025 for federal civilian executive branch networks.

CISA’s own alert is the record that those two bugs were not theoretical. Google’s current December page no longer prints an in-the-wild warning; the catalog entry is what remains on the public record.

🛡️ We added Android framework vulnerabilities CVE-2025-48572 & CVE-2025-48633 to our Known Exploited Vulnerabilities Catalog. Visit https://t.co/myxOwap1Tf & apply mitigations to protect your org from cyberattacks. #Cybersecurity #InfoSec pic.twitter.com/shAU5gIzHa

— CISA Cyber (@CISACyber) December 2, 2025

CVE-2025-48572 is one of 22 Framework privilege bugs still listed for December. CVE-2025-48633 is one of 4 Framework information-disclosure bugs. They are High, not Critical, which is why a reader who only skims severity stars can miss the pair CISA treated as urgent.

The Image Parser Google Had to Patch Twice

The sentence that still leads the December bulletin claims the worst issue is a Critical Framework flaw that can cause remote denial of service with no extra execution rights. That description matched CVE-2025-48631. The ID is gone from the December tables.

The CVE record places the bug in onHeaderDecoded in LocalImageResolver.java. A crafted image header can exhaust resources and leave a persistent denial of service, remotely, with no user tap. Google pulled it on January 8, 2026 because the Android 16 25Q4 patch was incomplete, while saying other Android versions were fine and that partners could keep what they had already shipped.

The replacement arrived in the March 2026 Android Security Bulletin, published March 2, 2026. There the same ID is a System DoS, still Critical, with the LocalImageResolver image-header fix listed for Android 14, 15, 16, and 16-qpr2. Android 13 is not on that March row. A device that only took the December string never had this ID as a requirement after January 8, and a device that kept the first patch still needed the March code for 16-qpr2.

The leftover lead sentence was not rewritten when the row vanished. The Critical bugs that remain on the December page live in the kernel and in Qualcomm’s closed-source list, not in Framework.

What Google’s NFC Payment Bug Allowed

CVE-2025-48612 is the withdrawal that reached the wallet. The later CVE text says that in setDefaultKey of DefaultPaymentSettings.java, improper input checks let an app set the main user’s default NFC payment method. No extra rights. No tap. CVSS 7.8.

Google cut it from the December bulletin on February 10, 2026, citing a possible regression that may limit switching default payment apps for contactless payments. Partners were again told they could keep the code. Anyone who installed that first patch may have closed a hijack path and opened a tap-to-pay settings failure. Anyone who skipped it kept the hijack path.

The restored fix landed in the June 2026 Android Security Bulletin, published June 1, 2026, as a System elevation of privilege, High, for Android 14, 15, 16, and 16-qpr2. Samsung’s June 2026 flagship maintenance release listed CVE-2025-48612 among the Google High patches in that package. CVE-2025-48615, pulled with CVE-2025-48600 on December 17, 2025, also returned on the June Framework table as High. CVE-2025-48600 did not reappear in the March or June issue lists that were checked for this piece, and the 48565 group was still waiting on a future bulletin as of the March 6, 2026 December note.

Critical Bugs Landed in Protected KVM

After the Framework Critical left, the December bulletin’s remaining Critical rows are kernel elevation of privilege and two Qualcomm closed-source issues. Three of the four kernel Criticals hit pKVM, the hypervisor under the Android Virtualization Framework.

CVE-2025-48623 is an out-of-bounds write in init_pkvm_hyp_vcpu in pkvm.c. CVE-2025-48637 and CVE-2025-48638 are also Critical pKVM privilege bugs. CVE-2025-48624 is a Critical privilege bug in IOMMU. None needs extra rights or a user tap. AVF’s security model treats pKVM as the layer that holds Android and guest virtual machines in mutually distrusted execution environments, including after the host is compromised. A privilege bug at that layer is a bug in the wall, not in an app sandbox.

Those four sit on the 2025-12-05 level with the chipset lists. The current tables, after the seven removals, break down like this.

DECEMBER BUGS BY COMPONENT

MediaTek’s 17 and Unisoc’s 13 are almost all modem-side High issues, 30 in total if those two lists are added. Qualcomm’s closed-source block holds CVE-2025-47319 and CVE-2025-47372 at Critical. Kernel LTS notes say an Android 12 device launched on 5.4 needs 5.4.292 as a minimum. The remaining Critical count on this bulletin is 6: 4 kernel, 2 Qualcomm closed-source.

Why the December Update Uses Two Patch Dates

Google splits most Android bulletins so a partner can ship shared platform fixes without waiting on every chipset blob. In this bulletin the split is unusually clean, because Mainline is empty.

WHAT EACH PATCH DATE COVERS

• 2025-12-01: All 43 remaining Framework and System issues on this page, plus every required fix from earlier bulletins. Build property [ro.build.version.security_patch]:[2025-12-01].
• 2025-12-05: Those 43, plus the 56 kernel and vendor IDs (Arm, Imagination, MediaTek, Unisoc, Qualcomm). Build property [ro.build.version.security_patch]:[2025-12-05].
• Mainline: No security issues in Google Play system updates this month, so a Play system update date cannot stand in for these fixes.

2025-12-05 or later patch levels are the ones Google says address all issues still listed here. A 2025-12-01 device can be current for the two CISA KEV Framework bugs and still miss pKVM, IOMMU, and the modem lists. Because Mainline shipped nothing, those kernel and vendor rows need a full vendor OTA.

To check a device’s security patch level, Google points users at the Pixel help page that also covers how the string is shown on its own devices. The string will not tell you whether a partner kept a withdrawn December fix, dropped it, or later took the March and June replacements.

Dolby, Trusty, and Pixel’s Extra Critical List

The Pixel Update Bulletin, published December 2, 2025, is a separate catalog. Google devices on 2025-12-05 get the Android bulletin and this extra list. The extra list is not required for an Android partner to declare that patch date.

Pixel’s table has 28 rows and 27 unique CVE IDs, because CVE-2025-32335 appears twice with two bug IDs in rild. Two of those unique IDs are Critical: CVE-2025-54957, remote code execution in Dolby, and CVE-2025-36935, elevation of privilege in Trusty. The rest of the Pixel-only pile sits in TPU, modem, AoC, camera, eSIM, and related blocks, all marked as not publicly available in AOSP.

A Pixel on 2025-12-05 has the platform rows, the kernel and vendor rows, and this extra Critical pair. A non-Pixel that only shows 2025-12-01 has the 43 Framework and System IDs, including the two CISA entries, and none of the pKVM Criticals. A non-Pixel on 2025-12-05 has the 99 IDs still printed on the Android bulletin and still lacks Pixel’s Dolby and Trusty rows, which were never part of that declaration.

The December 2025 string, as last revised on March 6, 2026, is complete only for the 99 IDs that remain on that page. It does not include the LocalImageResolver fix that returned in March 2026 or the NFC payment fix that returned in June 2026. Those are later patch dates, on later bulletins, and they are what actually closed the two holes Google had to take off this one.

Frequently Asked Questions

What do the 2025-12-01 and 2025-12-05 Android patch levels mean?

On this bulletin, 2025-12-01 is the Framework and System set only, 43 remaining CVE IDs plus prior required bulletins. 2025-12-05 adds the 56 kernel and chipset IDs. Google Play system updates listed no security issues this month, so a Mainline date cannot cover either set.

Which seven CVEs did Google remove from the December 2025 bulletin?

CVE-2025-48600, CVE-2025-48615, CVE-2025-48631, CVE-2025-48612, CVE-2025-48565, CVE-2025-48566, and CVE-2025-48564. The version table records two separate 1.3 edits, on January 8, 2026 and February 10, 2026, and each removal note says partners may keep the withdrawn code.

When did Google ship a complete fix for CVE-2025-48631?

The March 2026 bulletin, published March 2, 2026, lists CVE-2025-48631 again as a System Critical denial of service for Android 14, 15, 16, and 16-qpr2. That March row does not include Android 13, which had been in the original December framing.

Does a December 2025 patch level include the NFC payment fix?

No. CVE-2025-48612 left this bulletin on February 10, 2026 and returned in the June 2026 bulletin at the 2026-06-01 patch level as a System High elevation of privilege for Android 14, 15, 16, and 16-qpr2. Samsung listed that ID in its June 2026 flagship maintenance release.

How do I check my Android security patch level?

Manufacturers set the build property ro.build.version.security_patch to 2025-12-01 or 2025-12-05 when they claim this bulletin. Google’s Pixel help page is the official walkthrough for where that date appears in settings; matching 2025-12-05 still does not confirm the later March or June replacement fixes.