Google Android vulnerabilities

CVE-2026-0129 CVE-2026-0129: In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could le In RtcpByePacket::decodeByePacket, there is a possible due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2026-0143 CVE-2026-0143: In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a u In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0145 CVE-2026-0145: In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0125 CVE-2026-0125: In multiple functions of vpu_ioctl.c, there is a possible use after free due to a race condition. Th In multiple functions of vpu_ioctl.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0158 CVE-2026-0158: In Camera, there is a possible unauthorized way to access photos due to a missing permission check. In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-36850 [MEDIUM] CWE-20 CVE-2022-36850: Path traversal vulnerability in CallBGProvider prior to SMR Sep-2022 Release 1 allows attacker to ov Path traversal vulnerability in CallBGProvider prior to SMR Sep-2022 Release 1 allows attacker to overwrite arbitrary file with phone uid.

CVE-2013-4777 [MEDIUM] CWE-264 CVE-2013-4777: A certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless uses in A certain configuration of Android 2.3.7 on the Motorola Defy XT phone for Republic Wireless uses init to create a /dev/socket/init_runit socket that listens for shell commands, which allows local users to gain privileges by interacting with a LocalSocket object.

CVE-2016-3876 [MEDIUM] CWE-264 CVE-2016-3876: providers/settings/SettingsProvider.java in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 providers/settings/SettingsProvider.java in Android 6.x before 2016-09-01 and 7.0 before 2016-09-01 allows physically proximate attackers to bypass the SAFE_BOOT_DISALLOWED protection mechanism and boot to safe mode via the Android Debug Bridge (adb) tool, aka internal bug 29900345.

CVE-2019-20785 [MEDIUM] CWE-908 CVE-2019-20785: An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carri An issue was discovered on LG mobile devices with Android OS 8.0 and 8.1 software for the DTAG carrier. RILD in the radio layer uses an uninitialized variable. The LG ID is LVE-SMP-180013 (January 2019).

CVE-2019-20594 [MEDIUM] CWE-787 CVE-2019-20594: An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (Exynos chipsets) software. An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (Exynos chipsets) software. A heap overflow exists in the bootloader. The Samsung ID is SVE-2019-14371 (July 2019).

CVE-2018-21061 [MEDIUM] CWE-276 CVE-2018-21061: An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) software. A fake charger ca An issue was discovered on Samsung mobile devices with N(7.1) and O(8.x) software. A fake charger can execute critical functions in the locked state. The Samsung ID is SVE-2016-6341 (August 2018).

CVE-2015-6618 [MEDIUM] CWE-254 CVE-2015-6618: Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execut Bluetooth in Android 4.4 and 5.x before 5.1.1 LMY48Z allows user-assisted remote attackers to execute arbitrary code by leveraging access to the local physical environment, aka internal bug 24595992.

CVE-2016-3882 [MEDIUM] CWE-284 CVE-2016-3882: Off-by-one error in server/wifi/anqp/VenueNameElement.java in Wi-Fi in Android 6.x before 2016-10-01 Off-by-one error in server/wifi/anqp/VenueNameElement.java in Wi-Fi in Android 6.x before 2016-10-01 and 7.0 before 2016-10-01 allows remote attackers to cause a denial of service (reboot) via an access point that provides a crafted (1) Venue Group or (2) Venue Type value, aka internal bug 29464811.

CVE-2019-20609 [MEDIUM] CWE-862 CVE-2019-20609: An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can use Smartwatch An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can use Smartwatch to view Secure Folder notification content. The Samsung ID is SVE-2019-13899 (April 2019).

CVE-2017-3749 [MEDIUM] CVE-2017-3749: On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed u On Lenovo VIBE mobile phones, the Idea Friend Android application allows private data to be backed up and restored via Android Debug Bridge, which allows tampering leading to privilege escalation in conjunction with CVE-2017-3748 and CVE-2017-3750.

CVE-2020-10845 [MEDIUM] CWE-362 CVE-2020-10845: An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There i An issue was discovered on Samsung mobile devices with O(8.x), P(9.0), and Q(10.0) software. There is a race condition leading to a use-after-free in MTP. The Samsung ID is SVE-2019-16520 (February 2020).

CVE-2018-21045 [MEDIUM] CWE-200 CVE-2018-21045: An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is Clipboar An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. There is Clipboard access in the lockscreen state via a copy-and-paste action. The Samsung ID is SVE-2018-13381 (December 2018).

CVE-2019-20554 [MEDIUM] CVE-2019-20554: An issue was discovered on Samsung mobile devices with O(8.x) software. Attackers can bypass Factory An issue was discovered on Samsung mobile devices with O(8.x) software. Attackers can bypass Factory Reset Protection (FRP) via an external keyboard. The Samsung ID is SVE-2019-15164 (October 2019).

CVE-2019-20569 [MEDIUM] CVE-2019-20569: An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can bypass Factory An issue was discovered on Samsung mobile devices with P(9.0) software. Attackers can bypass Factory Reset Protection (FRP) via the status bar. The Samsung ID is SVE-2019-15089 (September 2019).

CVE-2022-25822 [MEDIUM] CWE-362 CVE-2022-25822: An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash. An use after free vulnerability in sdp driver prior to SMR Mar-2022 Release 1 allows kernel crash.