August 2025: the bulletin, and what actually shipped
The bulletin lists CVEs. The public security tags carry the code. This page joins the two for Android 14 to 17: which CVEs have a public fix in each major's tags, which do not, and what the tags fix that no bulletin mentions.
At a glance
| Major | CVEs for it | Fixed | Probable | No public code | Security tags this month |
|---|---|---|---|---|---|
| Android 14 | 2 | 2 | 0 | 0 | none |
| Android 15 | 2 | 2 | 0 | 0 | none |
| Android 16 | 2 | 2 | 0 | 0 | none |
| Android 17 (pre-release, 17-next) | 0 | 0 | 0 | 0 | none |
The bulletin also has 3 vendor and kernel rows (closed-source components, kernel LTS) with no AOSP code to check; they are not counted above.
What this month's security tags add
No security tag was published this month.
Announced, with no public code
None this month.
Public before it was announced
The fixing commit was in a public security tag before the bulletin announced the CVE.
| CVE | Majors (tag where the fix is complete) | Public since | Days early |
|---|---|---|---|
| CVE-2025-22441 | 14 (r19), 15 (r7) | 2025-04-07 | 116 |
Fixed, by a probable match
None this month.
Security fixes no advisory mentions
Commits of this month's security tags whose bug ids are in no bulletin and no OSV advisory. Some are likely lower-severity fixes, some may become CVEs later.
No security tag this month.
Fix analysis AI-generated
For each CVE with a public fix, an analysis of Google's patch: root cause, how the fix works, what it covers and leaves out. Written by a model from the bulletin and the fixing diffs, then checked against the code by a second model. It can still be wrong: verify against the commit.
- CVE-2025-22441 · platform/frameworks/base
RemoteViews now builds the remote application Context from an ApplicationInfo fetched from PackageManager (keyed by package name and user id) instead of the parceled ApplicationInfo supplied by the RemoteViews-providing app, and the LoadedApk.checkAndUpdateApkPaths calls in RemoteViews and AppWidgetHostView are removed. - CVE-2025-48530 · platform/external/rust/crabbyavif (AVIF decoder library)
crabbyavif now allocates image planes with width and height rounded up to even values, allocates and reports only one chroma plane for the Android semi-planar formats (NV12/NV21/P010), and fixes per-format chroma plane width reporting, so plane buffers are no longer undersized for odd-dimension images. - CVE-2025-48533 · platform/frameworks/base
When the keyguard is locked and the activity does not request showWhenLocked, WindowManager now waits for the transition to finish before it removes the activity's starting (splash) window. Until then it reports the activity's other windows as not visible, so app content is not shown on a locked device during the unocclude animation.
Bulletin revisions
| Version | Date | Notes |
|---|---|---|
| 1.0 | August 4, 2025 | Bulletin published |
| 1.1 | September 11, 2025 | AOSP links added |
- No change seen since tracking started (2026-09-30).
Method and limits
Fixes are found in the public android-security-* tags by the bug id in the
commit message, then Change-Id and patch id against the bulletin's commit, then two probable
matches checked by content. "No public code" means no fixing commit in the ingested tags of
that major, not proof that no fix exists anywhere. When none of the code the bulletin's
commit patches exists in a major (removed or reworked before its release), the CVE is shown
as "patched code absent" instead. Vendor closed-source components and the kernel are out of
scope.
Data for this page (JSON).