Google Android vulnerabilities

CVE-2016-3856 [HIGH] CWE-19 CVE-2016-3856: netd in Android before 2016-08-05 mishandles tethering and stdio streams, which allows attackers to netd in Android before 2016-08-05 mishandles tethering and stdio streams, which allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted application, aka Qualcomm internal bug CR959631.

CVE-2025-22407 [MEDIUM] CWE-416 CVE-2025-22407: In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2011-1149 [HIGH] CWE-264 CVE-2011-1149: Android before 2.3 does not properly restrict access to the system property space, which allows loca Android before 2.3 does not properly restrict access to the system property space, which allows local applications to bypass the application sandbox and gain privileges, as demonstrated by psneuter and KillingInTheNameOf, related to the use of Android shared memory (ashmem) and ASHMEM_SET_PROT_MASK.

CVE-2026-0127 CVE-2026-0127: In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bound In NrmmMsgCodec::DecodeUPUTransparentContext of cn_NrmmDecoder.cpp, there is a possible out-of-bounds read due to memory corruption. This could lead to remote denial of service causing a communication processor crash with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2016-3890 [HIGH] CWE-264 CVE-2016-3890: The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5 The Java Debug Wire Protocol (JDWP) implementation in adb/sockets.cpp in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-09-01 mishandles socket close operations, which allows attackers to gain privileges via a crafted application, aka internal bug 28347842.

CVE-2016-0822 [HIGH] CWE-264 CVE-2016-0822: The MediaTek connectivity kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain The MediaTek connectivity kernel driver in Android 6.0.1 before 2016-03-01 allows attackers to gain privileges via a crafted application that leverages conn_launcher access, aka internal bug 25873324.

CVE-2022-25821 [HIGH] CWE-125 CVE-2022-25821: Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB re Improper use of SMS buffer pointer in Shannon baseband prior to SMR Mar-2022 Release 1 allows OOB read.

CVE-2017-13183 [HIGH] CWE-362 CVE-2017-13183: In the OMXNodeInstance::useBuffer and IOMX::freeBuffer functions, there is a possible use after free In the OMXNodeInstance::useBuffer and IOMX::freeBuffer functions, there is a possible use after free due to a race condition if the user frees the buffer while it's being used in another thread. This could lead to a local elevation of privilege enabling code execution as a privileged process with no additional execution privileges needed. User interac

CVE-2020-0256 [MEDIUM] CWE-787 CVE-2020-0256: In LoadPartitionTable of gpt.cc, there is a possible out of bounds write due to a missing bounds che In LoadPartitionTable of gpt.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege when inserting a malicious USB device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Androi

CVE-2016-3875 [MEDIUM] CWE-264 CVE-2016-3875: server/wm/WindowManagerService.java in Android 6.x before 2016-09-01 does not enforce the DISALLOW_S server/wm/WindowManagerService.java in Android 6.x before 2016-09-01 does not enforce the DISALLOW_SAFE_BOOT setting, which allows physically proximate attackers to bypass intended access restrictions and boot to safe mode via unspecified vectors, aka internal bug 26251884.

CVE-2020-25280 [MEDIUM] CVE-2020-25280: An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos and MediaTek chipsets) softwa An issue was discovered on Samsung mobile devices with Q(10.0) (Exynos and MediaTek chipsets) software. Unauthenticated attackers can execute LTE/5G commands by sending a debugging command over USB. The Samsung ID is SVE-2020-16979 (September 2020).

CVE-2022-20125 [MEDIUM] CVE-2022-20125: In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This In GBoard, there is a possible way to bypass factory reset protections due to a sandbox escape. This could lead to local escalation of privilege if an attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-1

CVE-2021-0703 [MEDIUM] CWE-416 CVE-2021-0703: In SecondStageMain of init.cpp, there is a possible use after free due to incorrect shared_ptr usage In SecondStageMain of init.cpp, there is a possible use after free due to incorrect shared_ptr usage. This could lead to local escalation of privilege if the attacker has physical access to the device, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-18456

CVE-2012-6702 [MEDIUM] CWE-310 CVE-2012-6702: Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it Expat, when used in a parser that has not called XML_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers to defeat cryptographic protection mechanisms via vectors involving use of the srand function.

CVE-2022-20034 [MEDIUM] CWE-295 CVE-2022-20034: In Preloader XFLASH, there is a possible escalation of privilege due to an improper certificate vali In Preloader XFLASH, there is a possible escalation of privilege due to an improper certificate validation. This could lead to local escalation of privilege for an attacker who has physical access to the device with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06160806; Issue ID: ALPS06160

CVE-2019-2199 [MEDIUM] CVE-2019-2199: In createSessionInternal of PackageInstallerService.java, there is a possible permissions bypass. Th In createSessionInternal of PackageInstallerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-138650665

CVE-2019-9384 [MEDIUM] CVE-2019-9384: In LockPatternUtils, there is a possible escalation of privilege due to an improper permissions chec In LockPatternUtils, there is a possible escalation of privilege due to an improper permissions check. This could lead to local bypass of the Lockguard with System execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-120568007

CVE-2018-9508 [MEDIUM] CWE-125 CVE-2018-9508: In smp_process_keypress_notification of smp_act.cc, there is a possible out of bounds read due to an In smp_process_keypress_notification of smp_act.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2

CVE-2020-0122 [MEDIUM] CWE-276 CVE-2020-0122: In the permission declaration for com.google.android.providers.gsf.permission.WRITE_GSERVICES in And In the permission declaration for com.google.android.providers.gsf.permission.WRITE_GSERVICES in AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.0 Android-8.1 Android

CVE-2019-9266 [MEDIUM] CWE-787 CVE-2019-9266: In sensorservice, there is a possible out of bounds write due to a missing bounds check. This could In sensorservice, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-119501435