Google Android vulnerabilities

CVE-2022-20467 [MEDIUM] CVE-2022-20467: In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-225880741

CVE-2021-39751 [MEDIUM] CWE-862 CVE-2021-39751: In Settings, there is a possible way to read Bluetooth device names without proper permissions due t In Settings, there is a possible way to read Bluetooth device names without proper permissions due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-172838801

CVE-2021-39769 [MEDIUM] CWE-276 CVE-2021-39769: In Device Policy, there is a possible way to determine whether an app is installed, without query pe In Device Policy, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-193663287

CVE-2021-39779 [MEDIUM] CWE-276 CVE-2021-39779: In getCallStateUsingPackage of Telecom Service, there is a missing permission check. This could lead In getCallStateUsingPackage of Telecom Service, there is a missing permission check. This could lead to local information disclosure of the call state with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-190400974

CVE-2021-39774 [MEDIUM] CWE-125 CVE-2021-39774: In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-205989472

CVE-2022-30758 [MEDIUM] CWE-276 CVE-2022-30758: Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attac Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to access some protected information with privilege of Finder.

CVE-2024-49740 [MEDIUM] CWE-400 CVE-2024-49740: In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-43083 [MEDIUM] CWE-770 CVE-2024-43083: In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to In validate of WifiConfigurationUtil.java , there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21296 [MEDIUM] CWE-203 CVE-2023-21296: In Permission, there is a possible way to determine whether an app is installed, without query permi In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2022-20278 [MEDIUM] CWE-532 CVE-2022-20278: In Accounts, there is a possible way to write sensitive information to the system log due to insuffi In Accounts, there is a possible way to write sensitive information to the system log due to insufficient log filtering. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-205130113

CVE-2022-20270 [MEDIUM] CVE-2022-20270: In Content, there is a possible way to learn gmail account name on the device due to a permissions b In Content, there is a possible way to learn gmail account name on the device due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-209005023

CVE-2022-20357 [MEDIUM] CWE-908 CVE-2022-20357: In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitiali In writeToParcel of SurfaceControl.cpp, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-214999987

CVE-2023-21383 [MEDIUM] CVE-2023-21383: In Settings, there is a possible way for the user to unintentionally send extra data due to an uncle In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt. This could lead to local information disclosure with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2022-44421 [MEDIUM] CWE-862 CVE-2022-44421: In wlan driver, there is a possible missing permission check. This could lead to local In wlan drive In wlan driver, there is a possible missing permission check. This could lead to local In wlan driver, information disclosure.

CVE-2023-35677 [MEDIUM] CWE-862 CVE-2023-35677: In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a In onCreate of DeviceAdminAdd.java, there is a possible way to forcibly add a device admin due to a missing permission check. This could lead to local denial of service (factory reset or continuous locking) with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20323 [MEDIUM] CWE-862 CVE-2022-20323: In PackageManager, there is a possible package installation disclosure due to a missing permission c In PackageManager, there is a possible package installation disclosure due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-187176203

CVE-2025-26456 [MEDIUM] CWE-703 CVE-2025-26456: In multiple functions of DexUseManagerLocal.java, there is a possible way to crash system server due In multiple functions of DexUseManagerLocal.java, there is a possible way to crash system server due to a logic error in the code. This could lead to local permanent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-20665 [MEDIUM] CWE-538 CVE-2025-20665: In devinfo, there is a possible information disclosure due to a missing SELinux policy. This could l In devinfo, there is a possible information disclosure due to a missing SELinux policy. This could lead to local information disclosure of device identifier with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09555228; Issue ID: MSV-2760.

CVE-2023-21302 [MEDIUM] CWE-203 CVE-2023-21302: In Package Manager, there is a possible way to determine whether an app is installed, without query In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21306 [MEDIUM] CWE-203 CVE-2023-21306: In ContentService, there is a possible way to read installed sync content providers due to side chan In ContentService, there is a possible way to read installed sync content providers due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.