Android Patch Gap Absurdity2026-06-07, 3mins
As I write this, the date is October 3rd 2025. I want to give a real world example of a CVE that Android isn't patching until their security update to be released on months from now, or "today" as you're likely reading this. In question will be CVE-2025-6965 and its embargoed identical twin CVE-2025-48595.
- 2025-0?-??: A vulnerability was found in sqlite. I could not find the report.
- 2025-06-27: sqlite fixed the issue.
- 2025-06-28: sqlite released 3.50.2 with the fix.
- 2025-07-15: Google requested CVE-2025-6965 for the issue.
- 2025-07-24: sqlite released 3.44.5 LTS with the fix. This is the branch notably used by Android 16.
- 2025-0?-??: The Android team decides to pull in the new release and makes it available as part of their new security preview program for partners.
- 2025-09-25: GrapheneOS is the first known vendor to provide these binary-only security fixes via their new opt-in security channel.
- 2025-09-30: I noticed Fedora shipped this fix and put it on my TODO list to check Android.
- 2025-10-02: I saw that Android 16 was shipping sqlite 3.44.3 and I backported this and another CVE and sent it off to GrapheneOS for inclusion.
- 2025-10-02: GrapheneOS quickly responded and instead upgraded to 3.44.5, benefiting their regular channel users too.
- 2026-06-01: With June's public release you can see that Google's CVE-2025-48595 patch is just updating to 3.44.5 in order to fix CVE-2025-6965.
- In the coming weeks/months vendors will release this update and users can install it.
This was a 339 day delay from fix to release. This is just one example but this unacceptable delay is not the exception, but closer to the norm. Google's move to effectively only providing zero day fixes in monthly updates and lesser critical & high fixes via quarterly updates is a mistake and directly harms users. The goal should've been to shrink the patch gap, not add a three+ month delay to it. At the very least their new embargo makes an exception for binary-releases, so maybe some vendors will decide to do right by their users and ship the preview fixes early.
Editor note: I originally intended to publish this first on January 5th and again on March 2nd, but it only now was released in the June ASB. GrapheneOS has their comments on it here.