Google Android vulnerabilities

CVE-2022-20537 [LOW] CWE-862 CVE-2022-20537: In createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable loc In createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive settings due to a missing permission check. This could lead to local escalation of privilege from the Guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: And

CVE-2026-0056 [LOW] CWE-120 CVE-2026-0056: In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds che In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20446 [LOW] CWE-862 CVE-2022-20446: In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the mi In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-

CVE-2022-24929 [LOW] CWE-926 CVE-2022-24929: Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list o Unprotected Activity in AppLock prior to SMR Mar-2022 Release 1 allows attacker to change the list of locked app without authentication.

CVE-2023-44129 [LOW] CWE-926 CVE-2023-44129: The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-cont The vulnerability is that the Messaging ("com.android.mms") app patched by LG forwards attacker-controlled intents back to the attacker in the exported "com.android.mms.ui.QClipIntentReceiverActivity" activity. The attacker can abuse this functionality by launching this activity and then sending a broadcast with the "com.lge.message.action.QCLIP" actio

CVE-2025-26419 [LOW] CWE-290 CVE-2025-26419: In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic err In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2023-21278 [LOW] CVE-2023-21278: In multiple locations, there is a possible way to obscure the microphone privacy indicator due to a In multiple locations, there is a possible way to obscure the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26461 [LOW] CWE-703 CVE-2025-26461: In Permission Manager, there is a possible way for the microphone privacy indicator to remain activa In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to close the app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2016-3763 [LOW] CWE-20 CVE-2016-3763: net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x net/PacProxySelector.java in the Proxy Auto-Config (PAC) feature in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-07-01 does not ensure that URL information is restricted to a scheme, host, and port, which allows remote attackers to discover credentials by operating a server with a PAC script, aka internal bug 275939

CVE-2023-40122 [LOW] CVE-2023-40122: In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20280 [LOW] CWE-89 CVE-2022-20280: In MMSProvider, there is a possible read of protected data due to improper input validationSQL injec In MMSProvider, there is a possible read of protected data due to improper input validationSQL injection. This could lead to local information disclosure of sms/mms data with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-204117261

CVE-2019-9280 [LOW] CVE-2019-9280: In keyguard, there is a possible escalation of privilege due to improper permission checks. This cou In keyguard, there is a possible escalation of privilege due to improper permission checks. This could lead to a local bypass of the keyguard under limited circumstances, with User execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-119322269

CVE-2020-0481 [LOW] CWE-863 CVE-2020-0481: In AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation In AndroidManifest.xml, there is a possible permissions bypass. This could lead to local escalation of privilege allowing a non-system app to send a broadcast it shouldn't have permissions to send, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-157472962

CVE-2024-0053 [LOW] CWE-497 CVE-2024-0053: In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's im In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20528 [LOW] CWE-125 CVE-2022-20528: In findParam of HevcUtils.cpp there is a possible out of bounds read due to a missing bounds check. In findParam of HevcUtils.cpp there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-230172711

CVE-2024-0037 [LOW] CWE-862 CVE-2024-0037: In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a diff In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2021-0992 [LOW] CWE-1021 CVE-2021-0992: In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app wi In onCreate of PaymentDefaultDialog.java, there is a possible way to change a default payment app without user consent due to tapjack overlay. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-12Android ID: A-180104327

CVE-2021-25484 [LOW] CWE-287 CVE-2021-25484: Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the Improper authentication in InputManagerService prior to SMR Oct-2021 Release 1 allows monitoring the touch event.

CVE-2022-25817 [LOW] CWE-287 CVE-2022-25817: Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate p Improper authentication in One UI Home prior to SMR Mar-2022 Release 1 allows attacker to generate pinned-shortcut without user consent.

CVE-2022-25833 [LOW] CWE-287 CVE-2022-25833: Improper authentication in ImsService prior to SMR Apr-2022 Release 1 allows attackers to get IMSI w Improper authentication in ImsService prior to SMR Apr-2022 Release 1 allows attackers to get IMSI without READ_PRIVILEGED_PHONE_STATE permission.