Google Android vulnerabilities

CVE-2021-0466 [HIGH] CWE-330 CVE-2021-0466: In startIpClient of ClientModeImpl.java, there is a possible identifier which could be used to track In startIpClient of ClientModeImpl.java, there is a possible identifier which could be used to track a device. This could lead to remote information disclosure to a proximal attacker, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10Android ID: A-154114734

CVE-2026-0095 [HIGH] CWE-190 CVE-2026-0095: In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption wi In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20224 [HIGH] CWE-125 CVE-2022-20224: In AT_SKIP_REST of bta_hf_client_at.cc, there is a possible out of bounds read due to an incorrect b In AT_SKIP_REST of bta_hf_client_at.cc, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote information disclosure in the Bluetooth stack with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAn

CVE-2024-0015 [HIGH] CWE-280 CVE-2024-0015: In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protecte In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-43097 [HIGH] CWE-787 CVE-2024-43097: In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overfl In resizeToAtLeast of SkRegion.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48611 [HIGH] CWE-120 CVE-2025-48611: In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds chec In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48535 [HIGH] CWE-502 CVE-2025-48535: In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to expl In assertSafeToStartCustomActivity of AppRestrictionsFragment.java , there is a possible way to exploit a parcel mismatch resulting in a launch anywhere vulnerability due to unsafe deserialization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-34740 [HIGH] CWE-190 CVE-2024-34740: In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbit In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0071 [HIGH] CWE-862 CVE-2026-0071: In SettingsLib, there is a possible missing permission check due to a logic error in the code. This In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48565 [HIGH] CVE-2025-48565: In multiple locations, there is a possible way to bypass the cross profile intent filter due to a lo In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-0038 [HIGH] CWE-862 CVE-2024-0038: In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48580 [HIGH] CVE-2025-48580: In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission w In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-31335 [HIGH] CWE-783 CVE-2024-31335: In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-40671 [HIGH] CWE-862 CVE-2024-40671: In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code e In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible way to achieve arbitrary code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58846 [HIGH] CWE-269 CVE-2026-58846: In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58941 [HIGH] CWE-20 CVE-2026-58941: In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-31316 [HIGH] CVE-2024-31316: In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary backgroun In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-34726 [HIGH] CWE-783 CVE-2024-34726: In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-31337 [HIGH] CVE-2024-31337: In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper in In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-34720 [HIGH] CWE-783 CVE-2024-34720: In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_Zygot In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_ZygoteCommandBuffer.cpp, there is a possible method to perform arbitrary code execution in any app zygote processes due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User intera