Google’s June 2026 Android security update fixes 124 vulnerabilities, and one of them is already being used in attacks. As reported by BleepingComputer, the standout is CVE-2025-48595, a high-severity flaw in the Android Framework that lets a local attacker escalate privileges on a device with no user interaction needed. Google says there are indications it’s under “limited, targeted” exploitation, and it affects devices running Android 14, 15 and 16. The bug has since been added to the US CISA Known Exploited Vulnerabilities catalogue.

Here’s why this matters for your business: staff phones and tablets are part of your attack surface, not just personal kit. They hold work email, authenticator apps, and saved logins. A privilege-escalation flaw like this lets an attacker who already has a foothold take full control of the device, and from there your Microsoft 365 sign-ins are within reach. The catch is patch timing. Google Pixel devices get the fix straight away, but Samsung and other vendors take longer to roll it out, and cheaper Android handsets may never receive it at all.

So do two things this week. First, update any Android device used for work now: open Settings, then System, then Software update, and confirm the security patch level shows 2026-06-05 or later. If you manage a fleet through Intune or another MDM, push the update and check compliance. Second, retire devices that no longer get security updates, because an unpatchable phone with access to company data is a liability. If nobody is centrally managing staff devices, that’s the gap worth closing first.

If you’re not sure which devices are covered, our managed cybersecurity team can get mobile devices patched, monitored, and brought under proper management.