Android Framework known exploited vulnerabilities, ranked
CISA lists 6 Android Framework CVEs as exploited in the wild. 3 were added in the last 12 months and 0 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2023-35674: EPSS 2.6%, added 2023-09-13
- CVE-2025-48595: EPSS 1.7%, added 2026-06-02
- CVE-2023-20963: EPSS 1.5%, added 2023-04-13
- CVE-2024-43093: EPSS 0.7%, added 2024-11-07
- CVE-2025-48633: EPSS 0.3%, added 2025-12-02
All 6 Android Framework CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2023-35674 | Framework Privilege Escalation | 2.6% | – | 2023-09-13 | 2023-10-04 |
| 2 | CVE-2025-48595 | Framework Integer Overflow | 1.7% | – | 2026-06-02 | 2026-06-05 |
| 3 | CVE-2023-20963 | Framework Privilege Escalation | 1.5% | – | 2023-04-13 | 2023-05-04 |
| 4 | CVE-2024-43093 | Framework Privilege Escalation | 0.7% | – | 2024-11-07 | 2024-11-28 |
| 5 | CVE-2025-48633 | Framework Information Disclosure | 0.3% | – | 2025-12-02 | 2025-12-23 |
| 6 | CVE-2025-48572 | Framework Privilege Escalation | 0.3% | – | 2025-12-02 | 2025-12-23 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Android KEV CVEs · free KEV badge for Android · all vendors