自 2025 年 3 月 27 日起，我們建議您使用 android-latest-release 而非 aosp-main 建構及貢獻 AOSP。詳情請參閱「Android 開放原始碼計畫變更」。
Android 16 安全性版本資訊
透過集合功能整理內容
你可以依據偏好儲存及分類內容。
發布日期：2025 年 6 月 10 日
這份 Android 安全性版本資訊列舉影響 Android 裝置的安全漏洞，並說明相關細節。這些漏洞已在 Android 16 中解決。如果 Android 16 裝置的安全性修補程式等級在 2025-07-01 以後，就不受這些問題影響。在 Android 開放原始碼計畫中，Android 16 的預設安全性修補程式等級為 2025-07-01。請參閱關於檢查及更新 Android 版本的說明文章，瞭解如何查看裝置的安全性修補程式等級。
Android 的合作夥伴會提前收到公告中所有問題的相關通知。這些問題的原始碼修補程式將隨 Android 16 發布到 Android 開放原始碼計畫 (AOSP) 存放區。
版本資訊列出的安全漏洞嚴重程度評定標準，是假設平台與服務的資安因應措施因開發需求關閉或遭人規避，然後推估有人運用安全漏洞攻擊時，裝置會受到多大影響，據此判定安全漏洞嚴重程度。
目前還沒有客戶指出有人明顯濫用這些新漏洞。 如果想進一步瞭解 Android 安全性平台防護措施和 Google Play 安全防護機制如何加強 Android 平台的安全性，請參閱 Android 和 Google Play 安全防護機制所提供的因應措施。
公告事項
- 本文所述的漏洞已在 Android 16 中解決。我們秉持資訊公開原則提供相關資訊，方便使用者參考。
- 我們在此向安全性研究社群致謝，感謝他們對 Android 生態系統安全性的持續貢獻。
Android 和 Google 服務的資安因應措施
本節概述 Android 安全性平台和 Google Play 安全防護等服務防護方案所提供的因應措施。這些措施可有效防範有心人士在 Android 系統上惡意運用安全漏洞來達到特定目的。
- Android 平台持續推出新的版本來強化安全性，因此有心人士越來越難在 Android 系統上找出漏洞加以利用。我們建議所有使用者盡可能更新至最新版的 Android。
- Android 安全性團隊透過 Google Play 安全防護主動監控濫用情形，並向使用者警示可能有害的應用程式。在預設情況下，搭載 Google 行動服務的裝置會自動啟用 Google Play 安全防護機制。使用者如果不是從 Google Play 安裝應用程式，這項防護措施格外重要。
Android 16 安全漏洞詳情
下列各節詳列已在 Android 16 中解決的安全漏洞，我們依照受影響的元件將安全漏洞分類，並附上詳細資料，例如 CVE、相關參考資料、安全漏洞類型和嚴重程度。
架構
| CVE |
參考資料 |
類型 |
嚴重性 |
| CVE-2025-32320 |
A-322818950 |
EoP |
高 |
| CVE-2024-0028 |
A-285588444 |
ID |
高 |
| CVE-2025-26461 |
A-404548070 |
ID |
高 |
| CVE-2025-32317 |
A-369137473 |
ID |
高 |
系統
| CVE |
參考資料 |
類型 |
嚴重性 |
| CVE-2025-32318 |
A-383366951 |
EoP |
最高 |
| CVE-2025-26434 |
A-367969933 |
ID |
高 |
| CVE-2025-32316 |
A-283457989 |
ID |
高 |
常見問題與解答
如果您在閱讀這篇公告後有任何疑問，可參考本節的常見問答。
1. 如何判斷目前的裝置軟體版本已修正這些問題？
請參閱檢查及更新 Android 版本一文，瞭解如何查看裝置的安全性修補程式等級。
透過 Android 開放原始碼計畫發布的 Android 16 預設安全性修補程式等級為 2025-07-01。如果 Android 16 裝置使用 2025-07-01 之後的安全性修補程式等級，就已經解決這些安全性版本資訊提到的所有問題。
2. 「類型」欄中的項目代表什麼意義？
在安全漏洞詳情表中，「類型」欄中的項目代表安全漏洞類別。
| 縮寫 |
定義 |
| RCE |
遠端程式碼執行 |
| EoP |
權限提升 |
| ID |
資訊外洩 |
| DoS |
阻斷攻擊 |
| N/A |
未分類 |
3. 「參考資料」欄底下列出的識別碼代表什麼意義？
安全漏洞詳情表格中「參考資料」欄底下的項目可能會包含一個前置字串，用以表示該參考資料值所屬的機構或公司。
| 前置字串 |
參考資料 |
| A- |
Android 錯誤 ID |
版本
| 版本 |
日期 |
附註 |
| 1.0 |
2025 年 6 月 10 日 |
發布公告 |
這個頁面中的內容和程式碼範例均受《內容授權》中的授權所規範。Java 與 OpenJDK 是 Oracle 和/或其關係企業的商標或註冊商標。
上次更新時間：2025-08-14 (世界標準時間)。
[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["缺少我需要的資訊","missingTheInformationINeed","thumb-down"],["過於複雜/步驟過多","tooComplicatedTooManySteps","thumb-down"],["過時","outOfDate","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["示例/程式碼問題","samplesCodeIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-08-14 (世界標準時間)。"],[],[],null,["# Android 16 Security Release Notes\n\n*Published June 10, 2025*\n\nThis Android Security Release Notes contains details of security vulnerabilities affecting\nAndroid devices which are addressed as part of Android 16. Android 16 devices with a security\npatch level of 2025-07-01 or later are protected against these\nissues (Android 16, as released on AOSP, will have a default security patch level of 2025-07-01).\nTo learn how to check a device's security patch level, see\n[Check and update your Android version](https://support.google.com/pixelphone/answer/4457705).\n\nAndroid partners are notified of all issues prior to publication. Source code patches for these issues will be released to the Android Open Source Project (AOSP) repository as part of the Android 16 release.\n\nThe [severity assessment](/docs/security/overview/updates-resources#severity) of issues in these release notes are based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed.\n\nWe have had no reports of active customer exploitation or abuse of these newly reported issues. Refer to the [Android and Google Play Protect\nmitigations](#mitigations) section for details on the\n[Android security platform protections](/security/enhancements)\nand Google Play Protect, which improve the security of the Android platform.\n\nAnnouncements\n-------------\n\n- The issues described in this document are addressed as part of Android 16. This information is provided for reference and transparency.\n- We would like to [acknowledge and thank](/security/overview/acknowledgements) the security research community for their continued contributions towards securing the Android ecosystem.\n\nAndroid and Google service mitigations\n--------------------------------------\n\nThis is a summary of the mitigations provided by the\n[Android security platform](/security/enhancements) and service\nprotections such as\n[Google Play\nProtect](https://developers.google.com/android/play-protect). These capabilities reduce the likelihood that security\nvulnerabilities could be successfully exploited on Android.\n\n- Exploitation for many issues on Android is made more difficult by enhancements in newer versions of the Android platform. We encourage all users to update to the latest version of Android where possible.\n- The Android security team actively monitors for abuse through [Google Play\n Protect](https://developers.google.com/android/play-protect) and warns users about [Potentially\n Harmful Applications](/static/security/reports/Google_Android_Security_PHA_classifications.pdf). Google Play Protect is enabled by default on devices with [Google Mobile\n Services](http://www.android.com/gms), and is especially important for users who install apps from outside of Google Play.\n\nAndroid 16 vulnerability details\n--------------------------------\n\n\nThe sections below provide details for security vulnerabilities fixed as part of Android 16. Vulnerabilities are grouped under the component that they affect and include details such as the CVE, associated references, [type of vulnerability](https://support.google.com/androidpartners_security/answer/7067506#vulnerability-type), and [severity](/docs/security/overview/updates-resources#severity).\n\n### Framework\n\n| CVE | References | Type | Severity |\n|----------------|-------------|------|----------|\n| CVE-2025-32320 | A-322818950 | EoP | High |\n| CVE-2024-0028 | A-285588444 | ID | High |\n| CVE-2025-26461 | A-404548070 | ID | High |\n| CVE-2025-32317 | A-369137473 | ID | High |\n\n### System\n\n| CVE | References | Type | Severity |\n|----------------|-------------|------|----------|\n| CVE-2025-32318 | A-383366951 | EoP | Critical |\n| CVE-2025-26434 | A-367969933 | ID | High |\n| CVE-2025-32316 | A-283457989 | ID | High |\n\nCommon questions and answers\n----------------------------\n\nThis section answers common questions that may occur after reading this bulletin.\n\n**1. How do I determine if my device is updated to address these\nissues?**\n\nTo learn how to check a device's security patch level, see\n[Check and update your Android version](https://support.google.com/pixelphone/answer/4457705#pixel_phones&nexus_devices).\n\nAndroid 16, as released on AOSP, has a default security patch level of 2025-07-01. Android devices running Android 16 and with a security patch level of 2025-07-01 or later address all issues contained in these security release notes.\n\n**2. What do the entries in the *Type* column mean?**\n\nEntries in the *Type* column of the vulnerability details table\nreference the classification of the security vulnerability.\n\n| Abbreviation | Definition |\n|--------------|------------------------------|\n| RCE | Remote code execution |\n| EoP | Elevation of privilege |\n| ID | Information disclosure |\n| DoS | Denial of service |\n| N/A | Classification not available |\n\n**3. What do the entries in the *References* column mean?**\n\nEntries under the *References* column of the vulnerability details table may contain a prefix identifying the organization to which the reference value belongs.\n\n| Prefix | Reference |\n|--------|----------------|\n| A- | Android bug ID |\n\nVersions\n--------\n\n| Version | Date | Notes |\n|---------|---------------|--------------------|\n| 1.0 | June 10, 2025 | Bulletin published |"]]
