Google Android vulnerabilities

CVE-2026-0123 [HIGH] CWE-787 CVE-2026-0123: In EfwApTransport::ProcessRxRing of efw_ap_transport.cc, there is a possible out of bounds write due In EfwApTransport::ProcessRxRing of efw_ap_transport.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-34732 [HIGH] CWE-362 CVE-2024-34732: In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race con In RGXMMUCacheInvalidate of rgxmem.c, there is a possible arbitrary code execution due to a race condition. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2015-7716 [CRITICAL] CVE-2015-7716: libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code libstagefright in Android 5.x before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 20721050, a different vulnerability than CVE-2015-3873.

CVE-2021-0431 [HIGH] CWE-125 CVE-2021-0431: In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds che In avrc_msg_cback of avrc_api.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure to a paired device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.1 Android-9 Android-10Android ID: A-1741

CVE-2024-31317 [HIGH] CWE-502 CVE-2024-31317: In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as an In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to unsafe deserialization. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48640 [HIGH] CWE-862 CVE-2025-48640: In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-45777 [HIGH] CVE-2023-45777: In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0082 [HIGH] CWE-453 CVE-2026-0082: In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permissi In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0063 [HIGH] CWE-269 CVE-2026-0063: In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier rest In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0081 [HIGH] CWE-862 CVE-2026-0081: In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0124 [HIGH] CWE-787 CVE-2026-0124: There is a possible out of bounds write due to a missing bounds check. This could lead to local esca There is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22437 [HIGH] CWE-693 CVE-2025-22437: In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28615 [HIGH] CWE-862 CVE-2026-28615: In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions byp In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48612 [HIGH] CWE-20 CVE-2025-48612: In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set t In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-49714 [HIGH] CWE-122 CVE-2024-49714: In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer over In avrc_vendor_msg of avrc_opt.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to paired device escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48623 [HIGH] CWE-787 CVE-2025-48623: In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input valid In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48638 [HIGH] CWE-787 CVE-2025-48638: In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input val In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28655 [HIGH] CWE-693 CVE-2026-28655: In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28658 [HIGH] CWE-693 CVE-2026-28658: In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the co In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28599 [HIGH] CWE-693 CVE-2026-28599: In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.