Google vulnerabilities

▾ SunlitGoogle · AndroidEPSS 0.14%via CVEORG

The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy

The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers to write arbitrary values to `Settings.Gl…

CVE-2026-58924None

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-contr…

CVE-2026-58925None

▾ SunlitGoogle · AndroidEPSS 0.15%via CVEORG

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unprivileged application with access to the…

CVE-2026-28645Medium· 6.8

▾ SunlitGoogle · AndroidEPSS 0.14%via CVEORG

In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code

In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges nee…

CVE-2026-59048None

▾ SunlitGoogle · AndroidEPSS 0.14%via CVEORG

In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check

In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploi…

CVE-2026-59022None

In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code

In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not …

CVE-2026-59012None

In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check

In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed…

CVE-2026-59011None

In multiple locations, there is a possible permission bypass due to a logic error in the code

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-59002None

In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code

In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code. This could lead to physical information disclosure with no additional execution privileges needed. User interaction is no…

CVE-2026-59001None

In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code

In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction i…

CVE-2026-58997None

▾ SunlitGoogle · AndroidEPSS 0.11%via CVEORG

In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure

In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not neede…

CVE-2026-58990None

In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow

In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not n…

CVE-2026-58976None

In getSelectionBySubIds of ProviderUtil.java, there is a possible cross-user data leak due to a logic error in the code

In getSelectionBySubIds of ProviderUtil.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is …

CVE-2026-58971None

▾ SunlitGoogle · AndroidEPSS 0.11%via CVEORG

In _mupdf_get_hdr of wprint_mupdf.c, there is a possible out-of-bounds read due to an integer overflow

In _mupdf_get_hdr of wprint_mupdf.c, there is a possible out-of-bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for ex…

CVE-2026-58963None

In multiple locations, there is a possible denial of service due to improper input validation

In multiple locations, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58969None

In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check

In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction …

CVE-2026-58953None

In dec_vlc_read of oapv_vlc.c, there is a possible out-of-bounds read due to a heap buffer overflow

In dec_vlc_read of oapv_vlc.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for expl…

CVE-2026-58951None

In multiple locations, there is a possible permission bypass due to a missing permission check

In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58882NonePoC

▾ TwilightGoogle · AndroidEPSS 0.19%via CVEORG

In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow

In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no additional execution privileges needed. User interaction is not needed for e…

CVE-2026-58870None

In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check

In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User intera…

CVE-2026-58945None

In multiple locations, there is a possible side channel information leak due to improperly used crypto

In multiple locations, there is a possible side channel information leak due to improperly used crypto. This could lead to paired device information disclosure with no additional execution privileges needed. User interaction is not neede…

CVE-2026-58883None

▾ SunlitGoogle · AndroidEPSS 0.17%via CVEORG

In multiple locations, there is a possible denial of service due to a logic error in the code

In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58938None

In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation

In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for e…

CVE-2026-28621None

In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check

In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is n…

CVE-2026-76028High· 8.8

▾ TwilightGoogle · ChromeEPSS 0.23%via CVEORG

Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page

Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-119264High· 8.8

▾ TwilightGoogle · ChromeEPSS 0.24%via CVEORG

Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page

Use after free in Dawn in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-119260High· 8.8

▾ TwilightGoogle · ChromeEPSS 0.24%via CVEORG

Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page

Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-119272Medium· 4.3

▾ SunlitGoogle · ChromeEPSS 0.16%via CVEORG

Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page

Incorrect authorization in FileSystem in Google Chrome prior to 156.0.8078.79 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

CVE-2026-119271High· 8.8

▾ TwilightGoogle · ChromeEPSS 0.22%via CVEORG

Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page

Uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: High)

CVE-2026-119270High· 8.8