Android vulnerabilities

CVEs whose affected-version data names the Android package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

442 CVEsRSS

CVE-2026-28647High· 7.8

3w ago

In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code

In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User int…

▾ Twilightgoogle · androidEPSS 0.07%via NVD

CVE-2026-28641High· 7.8

3w ago

In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code

In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution p…

▾ Twilightgoogle · androidEPSS 0.07%via NVD

CVE-2026-28640High· 7.8

3w ago

In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation

In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privile…

▾ Twilightgoogle · androidEPSS 0.07%via NVD

CVE-2026-28625High· 7.8

3w ago

In multiple locations, there is a possible permission bypass due to a logic error in the code

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

▾ Twilightgoogle · androidEPSS 0.07%via NVD

CVE-2026-103922Critical· 9.3PoC

3w ago

Capacitor is a cross-platform native runtime for web applications

Capacitor is a cross-platform native runtime for web applications. From 6.0.0 until 6.2.2, 7.6.9, 8.3.5, 8.4.3, and 8.5.1, the Android and iOS WebView navigation guard validates a target URL's host and scheme but not its path, allowing a…

Android vulnerabilities

In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code

In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code

In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input validation

In multiple locations, there is a possible permission bypass due to a logic error in the code

Capacitor is a cross-platform native runtime for web applications

In link_load_gnss_image of link_device.c, there is a possible out-of-bounds write due to a missing bounds check

In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code

In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code

In GPU, there is a possible permission bypass due to a logic error in the code

In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code

In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due to a logic error in the code

In smmu_detach_dev of arm-smmu-v3.c, there is a possible permission bypass due to a logic error in the code

In multiple locations, there is a possible escalation of privilege due to improper input validation

In platform_msg_handler_init of default_msg_handlers.c, there is a possible confused deputy due to a confused deputy

In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds write due to a race condition

In multiple functions of physmem_extmem_linux.c, there is a possible out-of-bounds read due to uninitialized data

In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race condition

In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check

In multiple locations, there is a possible use-after-free due to a race condition

In multiple locations, there is a possible out-of-bounds write due to a logic error in the code

In Vp9DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check

In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check

In CPM, there is a possible information disclosure due to a confused deputy

In Bootloader, there is a possible permission bypass due to a missing permission check

In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check

In printf of printf.c, there is a possible out-of-bounds write due to improper input validation

In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code

In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due to a logic error in the code

In multiple locations, there is a possible permission bypass due to an integer overflow

In Bootloader, there is a possible escalation of privilege due to a missing permission check