Google Android vulnerabilities

CVE-2026-45520 [HIGH] CWE-441 CVE-2026-45520: In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confu In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-21044 [CRITICAL] CWE-120 CVE-2018-21044: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.0) software. The sem Trustlet An issue was discovered on Samsung mobile devices with N(7.x) and O(8.0) software. The sem Trustlet has a buffer overflow that leads to arbitrary TEE code execution. The Samsung IDs are SVE-2018-13230, SVE-2018-13231, SVE-2018-13232, SVE-2018-13233 (December 2018).

CVE-2020-25278 [CRITICAL] CWE-787 CVE-2020-25278: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The Qur An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. The Quram image codec library allows attackers to overwrite memory and execute arbitrary code via crafted JPEG data that is mishandled during decoding. The Samsung IDs are SVE-2020-18088, SVE-2020-18225, SVE-2020-18301 (September 2020).

CVE-2025-0093 [HIGH] CWE-732 CVE-2025-0093: In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2017-13274 [CRITICAL] CWE-346 CVE-2017-13274: In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determin In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination. This could lead to incorrect security decisions with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0, 8.1. Android ID: A-71360761.

CVE-2015-3837 [CRITICAL] CWE-20 CVE-2015-3837: The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1. The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka internal bug 21437603.

CVE-2022-30722 [CRITICAL] CWE-285 CVE-2022-30722: Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows at Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows attackers to bypass user confirmation of Samsung Account.

CVE-2023-35649 [HIGH] CWE-787 CVE-2023-35649: In several functions of Exynos modem files, there is a possible out of bounds write due to a missing In several functions of Exynos modem files, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2021-0340 [HIGH] CWE-212 CVE-2021-0340: In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information du In parseNextBox of IsoInterface.java, there is a possible leak of unredacted location information due to improper input validation. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-134155286

CVE-2019-9232 [HIGH] CWE-125 CVE-2019-9232: In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to In libvpx, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-122675483

CVE-2018-9459 [HIGH] CWE-22 CVE-2018-9459: In Attachment of Attachment.java and getFilePath of EmlAttachmentProvider.java, there is a possible In Attachment of Attachment.java and getFilePath of EmlAttachmentProvider.java, there is a possible Elevation of Privilege due to a path traversal error. This could lead to a remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-6.0 Android-6.0.1 A

CVE-2014-7951 [MEDIUM] CWE-22 CVE-2014-7951: Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows phys Directory traversal vulnerability in the Android debug bridge (aka adb) in Android 4.0.4 allows physically proximate attackers with a direct connection to the target Android device to write to arbitrary files owned by system via a .. (dot dot) in the tar archive headers.

CVE-2017-0877 [HIGH] CWE-20 CVE-2017-0877: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Ver A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-66372937.

CVE-2017-0878 [HIGH] CWE-20 CVE-2017-0878: A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Ve A remote code execution vulnerability in the Android media framework (libhevc). Product: Android. Versions: 8.0. Android ID A-65186291.

CVE-2017-0872 [HIGH] CWE-20 CVE-2017-0872: A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Ve A remote code execution vulnerability in the Android media framework (libskia). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-65290323.

CVE-2017-0876 [HIGH] CWE-20 CVE-2017-0876: A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Ver A remote code execution vulnerability in the Android media framework (libavc). Product: Android. Versions: 6.0. Android ID A-64964675.

CVE-2017-13151 [HIGH] CWE-682 CVE-2017-13151: A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. V A remote code execution vulnerability in the Android media framework (libmpeg2). Product: Android. Versions: 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-63874456.

CVE-2018-9571 [HIGH] CWE-787 CVE-2018-9571: In impd_parse_loud_eq_instructions of impd_drc_dynamic_payload.c there is a possible out-of-bound wr In impd_parse_loud_eq_instructions of impd_drc_dynamic_payload.c there is a possible out-of-bound write due to missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-116020594.

CVE-2018-9569 [HIGH] CWE-787 CVE-2018-9569: In impd_init_drc_decode_post_config of impd_drc_gain_decoder.c there is a possible out-of-bound writ In impd_init_drc_decode_post_config of impd_drc_gain_decoder.c there is a possible out-of-bound write due to incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: Android. Versions: Android-9. Android ID: A-113885537.

CVE-2019-2062 [HIGH] CWE-787 CVE-2019-2062: In libxaac, there is a possible out of bounds write due to a missing bounds check. This could lead t In libxaac, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-117660045