Android vulnerabilities
CVEs whose affected-version data names the Android package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
442 CVEsRSS
CVE-2025-48640High· 8.0In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check
In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. …
CVE-2025-48617High· 7.8PoCIn overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass
In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is …
CVE-2025-48571Medium· 4.3In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code
In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. Use…
CVE-2026-0019High· 7.8In SettingsLib, there is a possible way to disable system components due to a logic error in the code
In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex…
CVE-2026-0157Medium· 4.3In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check
In RtcpHeader::decodeRtcpHeader, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0165Medium· 6.5In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check
In several functions of the RTCP packet decoder, there is a possible out-of-bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is n…
CVE-2026-0158Medium· 4.0In Camera, there is a possible unauthorized way to access photos due to a missing permission check
In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploi…
CVE-2026-0155Medium· 5.3In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check
In ImsMediaBitReader::ReadByteBuffer, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploit…
CVE-2026-0145Medium· 4.0In keymint, there is a possible Permission Bypass due to a logic error in the code
In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0144High· 7.5In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check
In writeAocCommand of AocAudioCodec.cpp, there is a possible memory safety issue due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed fo…
CVE-2026-0142Medium· 4.0In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation
In iavb_parse_key_data of avb_rsa.c, there is a possible out of bounds read due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed …
CVE-2026-0141Medium· 5.3In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check
In decodeAppPacket of RtcpAppPacket.cpp, there is a possible OOB read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for expl…
CVE-2026-0140Medium· 4.3In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow
In RtpPacket::decodePacket, there is a possible out-of-bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2026-0134Medium· 4.0In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code
In PostWipeData of recovery_ui.cpp, there is a possible data persistence issue after a factory reset due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User i…
CVE-2026-0130Medium· 4.3In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow
In RtcpChunk::decodeRtcpChunk, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploita…
CVE-2026-0136High· 7.5In Modem, there is a possible out of bounds read due to a missing bounds check
In Modem, there is a possible out of bounds read due to a missing bounds check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0129Medium· 4.3In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check
In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2026-0156High· 7.5In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check
In checkSsrcCollisionOnRcv of RtpSession.cpp, there is a possible memory safety issue due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed…
CVE-2026-0128Medium· 6.5⚖ disputedIn RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow
In RtcpFbPacket::decodeRtcpFbPacket, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for explo…
CVE-2026-0016Low· 3.3In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. This could lead to local information disclosure with no additional execution pr…
CVE-2026-0018Medium· 5.5In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validation
In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User…
CVE-2026-28581Medium· 4.0In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code. This could lead to local escalation with User execution privileges needed. User interaction …
CVE-2026-0009High· 7.8PoCIn multiple locations, there is a possible tapjacking due to a logic error in the code
In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0100High· 7.8In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow
In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploit…
CVE-2026-0099High· 7.8In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the code
In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges n…
CVE-2026-0098High· 7.8In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy
In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User intera…
CVE-2026-0097High· 8.0In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error
In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges neede…
CVE-2026-0096High· 7.8In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to misleading or insufficient UI
In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges…
CVE-2026-0095High· 8.0In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process due to an integer overflow
In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process due to an integer overflow. This could lead to local escalation of privilege with no additional exe…
CVE-2026-0094High· 7.8In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI
In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional ex…