Google Android vulnerabilities

CVE-2026-0010 [HIGH] CWE-787 CVE-2026-0010: In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bo In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0035 [HIGH] CWE-125 CVE-2026-0035: In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48579 [HIGH] CWE-441 CVE-2025-48579: In multiple functions of MediaProvider.java, there is a possible external storage write permission b In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0025 [HIGH] CWE-200 CVE-2026-0025: In hasImage of Notification.java, there is a possible way to reveal information across users due to In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0189 [HIGH] CWE-693 CVE-2026-0189: In ac_init_policy of init.c, there is a possible permission bypass due to a logic error in the code. In ac_init_policy of init.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56881 [HIGH] CWE-693 CVE-2026-56881: In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56941 [HIGH] CWE-693 CVE-2026-56941: In multiple functions of fpc_tee_hal.c, there is a possible use-after-free due to a logic error in t In multiple functions of fpc_tee_hal.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58679 [HIGH] CWE-122 CVE-2026-58679: In gf_ta_test_set_config of gf_ta_test.c, there is a possible heap buffer overflow due to a logic er In gf_ta_test_set_config of gf_ta_test.c, there is a possible heap buffer overflow due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48574 [HIGH] CWE-862 CVE-2025-48574: In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept dra In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0020 [HIGH] CWE-639 CVE-2026-0020: In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent d In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0034 [HIGH] CWE-20 CVE-2026-0034: In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy des In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56970 [HIGH] CWE-693 CVE-2026-56970: In multiple locations, there is a possible permission bypass due to a missing permission check. This In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-55301 [HIGH] CWE-120 CVE-2026-55301: In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds chec In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22404 [HIGH] CWE-416 CVE-2025-22404: In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a u In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22410 [HIGH] CWE-416 CVE-2025-22410: In multiple locations, there is a possible way to execute arbitrary code due to a use after free. Th In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22405 [HIGH] CWE-416 CVE-2025-22405: In multiple locations, there is a possible way to execute arbitrary code due to a use after free. Th In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56985 [HIGH] CWE-441 CVE-2026-56985: In multiple files, there is a possible way to obtain signatures due to type confusion. This could le In multiple files, there is a possible way to obtain signatures due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48636 [HIGH] CWE-22 CVE-2025-48636: In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22409 [HIGH] CWE-416 CVE-2025-22409: In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-32313 [HIGH] CWE-787 CVE-2025-32313: In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect boun In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.