Google Android

• CVE-2026-58704 High 8.8 Exploited In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges 0.6%
• CVE-2025-48595 High 8.4 Exploited In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. Us 1.9%
• CVE-2025-48633 Medium 5.5 Exploited In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code. This could lead to local escalation of pr 0.3%
• CVE-2025-48572 High 7.8 Exploited In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privi 0.3%
• CVE-2025-48543 High 8.8 Exploited In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional exe 0.7%
• CVE-2024-43093 High 7.3 Exploited In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. Thi 0.7%
• CVE-2024-32896 High 8.1 Exploited there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exp 3.0%
• CVE-2024-29748 High 7.8 Exploited there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exp 0.7%
• CVE-2024-29745 Medium 5.5 Exploited there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for 0.5%
• CVE-2023-35674 High 8.8 Exploited In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution 2.6%
• CVE-2026-58977 Medium 6.7 In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges neede <0.1%
• CVE-2026-58930 Unrated An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a sp 0.1%
• CVE-2026-58927 Unrated The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls from 0.2%
• CVE-2026-58926 Low 2.5 A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via `do <0.1%
• CVE-2026-58925 Unrated The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unpriv 0.1%
• CVE-2026-58924 Unrated The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an ou 0.2%
• CVE-2026-58915 Medium 6.1 A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure passeng 0.1%
• CVE-2026-49906 High 7.8 An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting navig 0.1%
• CVE-2026-49903 Unrated The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to w 0.1%
• CVE-2026-59048 Unrated In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User <0.1%
• CVE-2026-59047 Medium 6.2 In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interacti <0.1%
• CVE-2026-59046 Medium 6.2 In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional execution p <0.1%
• CVE-2026-59045 High 7.4 In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction <0.1%
• CVE-2026-59044 High 8.4 In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User intera 0.1%
• CVE-2026-59043 High 7.4 In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution pri <0.1%
• CVE-2026-59042 High 7.4 In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. Us <0.1%
• CVE-2026-59031 Medium 6.2 In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution <0.1%
• CVE-2026-59028 High 8.4 In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution pr <0.1%
• CVE-2026-59022 Unrated In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privil <0.1%
• CVE-2026-59021 Medium 6.2 In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not <0.1%
• CVE-2026-59020 Medium 5.9 In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service with User execution privileges needed. U <0.1%
• CVE-2026-59016 High 8.4 In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of privilege with no additional execution privileges <0.1%
• CVE-2026-59015 Medium 4.0 In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction <0.1%
• CVE-2026-59014 High 8.4 In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interac <0.1%
• CVE-2026-59012 Unrated In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no a <0.1%
• CVE-2026-59011 Unrated In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User inte <0.1%
• CVE-2026-59010 Medium 6.2 In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User intera <0.1%
• CVE-2026-59008 Medium 6.2 In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local denial of service with no additional execut <0.1%
• CVE-2026-59007 Medium 5.3 In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with no additional execution priv 0.2%
• CVE-2026-59006 Medium 4.0 In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution priv <0.1%
• CVE-2026-59005 High 8.4 In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution pr <0.1%
• CVE-2026-59004 High 8.4 In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege with no additional execution privileges needed. User interac <0.1%
• CVE-2026-59003 Medium 4.0 In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no add <0.1%
• CVE-2026-59002 Unrated In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code. This could lead to physical information disclosure with no additional execution priv 0.1%
• CVE-2026-59001 Unrated In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution 0.1%
• CVE-2026-59000 High 8.4 In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction 0.1%
• CVE-2026-58997 Unrated In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This could lead to local information disclosure with no additional execution privileges 0.1%
• CVE-2026-58995 High 8.4 In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges ne <0.1%
• CVE-2026-58994 High 8.4 In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privile <0.1%
• CVE-2026-58990 Unrated In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow. This could lead to remote information disclosure with no additional execution privile 0.2%