Google Android vulnerabilities

CVE-2026-28650 [HIGH] CWE-693 CVE-2026-28650: In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic er In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28639 [HIGH] CWE-693 CVE-2026-28639: In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28583 [HIGH] CWE-693 CVE-2026-28583: In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-55285 [HIGH] CWE-120 CVE-2026-55285: In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bo In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-49919 [HIGH] CWE-190 CVE-2026-49919: In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28593 [HIGH] CWE-356 CVE-2026-28593: In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleadi In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-55351 [HIGH] CWE-190 CVE-2026-55351: In VPU, there is a possible out-of-bounds write due to an integer overflow. This could lead to local In VPU, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-57014 [HIGH] CWE-787 CVE-2026-57014: In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds wri In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58744 [HIGH] CWE-20 CVE-2026-58744: In multiple locations, there is a possible escalation of privilege due to improper input validation. In multiple locations, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-55273 [HIGH] CWE-20 CVE-2026-55273: In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improp In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28653 [HIGH] CWE-787 CVE-2026-28653: In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overfl In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-49927 [HIGH] CWE-190 CVE-2026-49927: In multiple locations, there is a possible out of bounds write due to an integer overflow. This coul In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-49918 [HIGH] CWE-787 CVE-2026-49918: In multiple functions, there is a possible out of bounds write due to an integer overflow. This coul In multiple functions, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48583 [HIGH] CVE-2025-48583: In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48613 [HIGH] CWE-269 CVE-2025-48613: In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the origin In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the same key. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-47027 [HIGH] CWE-22 CVE-2024-47027: In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory a In sm_mem_compat_get_vmm_obj of lib/sm/shared_mem.c, there is a possible arbitrary physical memory access due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28631 [HIGH] CWE-601 CVE-2026-28631: In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a ta In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28644 [HIGH] CWE-441 CVE-2026-28644: In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypa In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-49887 [HIGH] CWE-288 CVE-2026-49887: In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28614 [HIGH] CWE-441 CVE-2026-28614: In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.