自 2025 年 3 月 27 日起，我们建议您使用 android-latest-release 而非 aosp-main 构建 AOSP 并为其做出贡献。如需了解详情，请参阅 AOSP 的变更。
Android 16 安全性版本说明
使用集合让一切井井有条
根据您的偏好保存内容并对其进行分类。
发布时间：2025 年 6 月 10 日
本 Android 安全性版本说明详细介绍了会影响 Android 设备的安全漏洞，这些漏洞已在 Android 16 中得到解决。如果 Android 16 设备的安全补丁级别为 2025-07-01 或更新，则不会受到这些问题的影响（在 AOSP 上发布的 Android 16 的默认安全补丁级别将为 2025-07-01）。
如需了解如何查看设备的安全补丁级别，请参阅查看并更新 Android 版本。
Android 合作伙伴在本公告发布前就已收到关于所有问题的通知。我们会在 Android 16 版本中将针对这些问题的源代码补丁发布到 Android 开源项目 (AOSP) 代码库中。
对于这些版本说明中所述的问题，评估严重程度时依据的是漏洞被利用后可能会对受影响设备造成的影响（假设相关平台和服务缓解措施被成功规避或出于开发目的而被停用）。
尚未有人向我们举报过有用户主动利用或滥用这些新报告的问题。请参阅 Android 和 Google Play 保护机制提供的缓解措施部分，详细了解有助于提高 Android 平台安全性的 Android 安全平台防护功能和 Google Play 保护机制。
通告
- 本文档中所述的问题已在 Android 16 中得到解决。这些信息仅供参考并向用户公开。
- 我们衷心感谢安全研究社区对保护 Android 生态系统持续做出的贡献。
Android 和 Google 服务缓解措施
这一部分总结了 Android 安全平台和服务防护功能（如 Google Play 保护机制）提供的缓解措施。这些功能有助于降低 Android 上的安全漏洞被成功利用的可能性。
- 较高版本的 Android 平台中提供的增强功能让攻击者更加难以利用 Android 上存在的许多问题。我们建议所有用户都尽可能更新到最新版 Android。
- Android 安全团队会积极利用 Google Play 保护机制监控滥用行为，并会在发现潜在有害应用时向用户发出警告。在安装有 Google 移动服务的设备上，Google Play 保护机制默认处于启用状态，对于从 Google Play 以外的来源安装应用的用户来说，该机制尤为重要。
Android 16 漏洞详情
以下部分提供了在 Android 16 中修复的安全漏洞的详细信息。漏洞列在其影响的组件下，并显示了 CVE、相关参考编号、漏洞类型和严重程度。
框架
| CVE |
参考编号 |
类型 |
严重程度 |
| CVE-2025-32320 |
A-322818950 |
EoP |
高 |
| CVE-2024-0028 |
A-285588444 |
ID |
高 |
| CVE-2025-26461 |
A-404548070 |
ID |
高 |
| CVE-2025-32317 |
A-369137473 |
ID |
高 |
系统
| CVE |
参考编号 |
类型 |
严重程度 |
| CVE-2025-32318 |
A-383366951 |
EoP |
严重 |
| CVE-2025-26434 |
A-367969933 |
ID |
高 |
| CVE-2025-32316 |
A-283457989 |
ID |
高 |
常见问题和解答
这一部分解答了用户在阅读本公告后可能会提出的常见问题。
1. 如何确定我的设备是否已通过更新解决了这些问题？
如需了解如何查看设备的安全补丁级别，请参阅查看和更新 Android 版本。
在 AOSP 上发布的 Android 16 的默认安全补丁级别为 2025-07-01。如果搭载 Android 16 的 Android 设备的安全补丁级别是 2025-07-01 或更新，则意味着已解决这些安全性版本说明中包含的所有问题。
2. “类型”列中的条目表示什么意思？
在漏洞详情表内，“类型”列中的条目是安全漏洞的分类。
| 缩写词 |
定义 |
| RCE |
远程代码执行 |
| EoP |
提权 |
| ID |
信息披露 |
| DoS |
拒绝服务攻击 |
| N/A |
没有分类 |
3. “参考编号”列中的条目表示什么意思？
在漏洞详情表内，“参考编号”列中的条目可能包含用于标识参考值所属组织的前缀。
| 前缀 |
参考编号 |
| A- |
Android bug ID |
版本
| 版本 |
日期 |
备注 |
| 1.0 |
2025 年 6 月 10 日 |
发布了本公告 |
本页面上的内容和代码示例受内容许可部分所述许可的限制。Java 和 OpenJDK 是 Oracle 和/或其关联公司的注册商标。
最后更新时间 (UTC)：2025-08-14。
[null,null,["最后更新时间 (UTC)：2025-08-14。"],[],[],null,["# Android 16 Security Release Notes\n\n*Published June 10, 2025*\n\nThis Android Security Release Notes contains details of security vulnerabilities affecting\nAndroid devices which are addressed as part of Android 16. Android 16 devices with a security\npatch level of 2025-07-01 or later are protected against these\nissues (Android 16, as released on AOSP, will have a default security patch level of 2025-07-01).\nTo learn how to check a device's security patch level, see\n[Check and update your Android version](https://support.google.com/pixelphone/answer/4457705).\n\nAndroid partners are notified of all issues prior to publication. Source code patches for these issues will be released to the Android Open Source Project (AOSP) repository as part of the Android 16 release.\n\nThe [severity assessment](/docs/security/overview/updates-resources#severity) of issues in these release notes are based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed.\n\nWe have had no reports of active customer exploitation or abuse of these newly reported issues. Refer to the [Android and Google Play Protect\nmitigations](#mitigations) section for details on the\n[Android security platform protections](/security/enhancements)\nand Google Play Protect, which improve the security of the Android platform.\n\nAnnouncements\n-------------\n\n- The issues described in this document are addressed as part of Android 16. This information is provided for reference and transparency.\n- We would like to [acknowledge and thank](/security/overview/acknowledgements) the security research community for their continued contributions towards securing the Android ecosystem.\n\nAndroid and Google service mitigations\n--------------------------------------\n\nThis is a summary of the mitigations provided by the\n[Android security platform](/security/enhancements) and service\nprotections such as\n[Google Play\nProtect](https://developers.google.com/android/play-protect). These capabilities reduce the likelihood that security\nvulnerabilities could be successfully exploited on Android.\n\n- Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.\n- The Android security team actively monitors for abuse through [Google Play\n Protect](https://developers.google.com/android/play-protect) and warns users about [Potentially\n Harmful Applications](/static/security/reports/Google_Android_Security_PHA_classifications.pdf). Google Play Protect is enabled by default on devices with [Google Mobile\n Services](http://www.android.com/gms), and is especially important for users who install apps from outside of Google Play.\n\nAndroid 16 vulnerability details\n--------------------------------\n\n\nThe sections below provide details for security vulnerabilities fixed as part of Android 16. Vulnerabilities are grouped under the component that they affect and include details such as the CVE, associated references, [type of vulnerability](https://support.google.com/androidpartners_security/answer/7067506#vulnerability-type), and [severity](/docs/security/overview/updates-resources#severity).\n\n### Framework\n\n| CVE | References | Type | Severity |\n|----------------|-------------|------|----------|\n| CVE-2025-32320 | A-322818950 | EoP | High |\n| CVE-2024-0028 | A-285588444 | ID | High |\n| CVE-2025-26461 | A-404548070 | ID | High |\n| CVE-2025-32317 | A-369137473 | ID | High |\n\n### System\n\n| CVE | References | Type | Severity |\n|----------------|-------------|------|----------|\n| CVE-2025-32318 | A-383366951 | EoP | Critical |\n| CVE-2025-26434 | A-367969933 | ID | High |\n| CVE-2025-32316 | A-283457989 | ID | High |\n\nCommon questions and answers\n----------------------------\n\nThis section answers common questions that may occur after reading this bulletin.\n\n**1. How do I determine if my device is updated to address these\nissues?**\n\nTo learn how to check a device's security patch level, see\n[Check and update your Android version](https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices).\n\nAndroid 16, as released on AOSP, has a default security patch level of 2025-07-01. Android devices running Android 16 and with a security patch level of 2025-07-01 or later address all issues contained in these security release notes.\n\n**2. What do the entries in the *Type* column mean?**\n\nEntries in the *Type* column of the vulnerability details table\nreference the classification of the security vulnerability.\n\n| Abbreviation | Definition |\n|--------------|------------------------------|\n| RCE | Remote code execution |\n| EoP | Elevation of privilege |\n| ID | Information disclosure |\n| DoS | Denial of service |\n| N/A | Classification not available |\n\n**3. What do the entries in the *References* column mean?**\n\nEntries under the *References* column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs.\n\n| Prefix | Reference |\n|--------|----------------|\n| A- | Android bug ID |\n\nVersions\n--------\n\n| Version | Date | Notes |\n|---------|---------------|--------------------|\n| 1.0 | June 10, 2025 | Bulletin published |"]]
