Google Android vulnerabilities

CVE-2026-28636 [HIGH] CWE-441 CVE-2026-28636: In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" securi In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28663 [HIGH] CWE-863 CVE-2026-28663: In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activi In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28600 [HIGH] CWE-441 CVE-2026-28600: In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28603 [HIGH] CWE-441 CVE-2026-28603: In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write a In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22424 [HIGH] CWE-20 CVE-2025-22424: In multiple locations, there is a possible way to reveal images across users due to improper input v In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2025-48643 [HIGH] CWE-20 CVE-2025-48643: In multiple locations there is a possible provisioning bypass due to improper input validation. This In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0045 [HIGH] CWE-693 CVE-2026-0045: In bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure connec In bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure connection due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48652 [HIGH] CWE-693 CVE-2025-48652: In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0087 [HIGH] CWE-693 CVE-2026-0087: In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hija In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app link due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48632 [HIGH] CWE-20 CVE-2025-48632: In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to p In setDisplayName of AssociationRequest.java, there is a possible way to cause CDM associations to persist after the user has disassociated them due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0078 [HIGH] CWE-20 CVE-2026-0078: In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48617 [HIGH] CWE-862 CVE-2025-48617: In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2016-3742 [CRITICAL] CWE-20 CVE-2016-3742: decoder/ih264d_process_intra_mb.c in mediaserver in Android 6.x before 2016-07-01 mishandles intra m decoder/ih264d_process_intra_mb.c in mediaserver in Android 6.x before 2016-07-01 mishandles intra mode, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28165659.

CVE-2026-55269 [HIGH] CWE-20 CVE-2026-55269: In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-49885 [HIGH] CWE-190 CVE-2026-49885: In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overfl In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0138 [HIGH] CWE-120 CVE-2026-0138: In lwis_io_buffer_write of lwis_io_buffer.c, there is a possible out of bounds write due to memory c In lwis_io_buffer_write of lwis_io_buffer.c, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0137 [HIGH] CWE-416 CVE-2026-0137: In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privile In edgetpu_sync_fence_group_shutdown() of edgetpu-dmabuf.c, there is a possible elevation of privilege due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28647 [HIGH] CWE-269 CVE-2026-28647: In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass du In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28641 [HIGH] CWE-269 CVE-2026-28641: In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a pos In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28648 [HIGH] CWE-441 CVE-2026-28648: In Settings, there is a possible permission bypass due to a confused deputy. This could lead to loca In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.