Google Android vulnerabilities

CVE-2026-28668 [HIGH] CWE-693 CVE-2026-28668: In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0065 [HIGH] CWE-693 CVE-2026-0065: In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible In areBackgroundActivityStartsAllowed of BackgroundLaunchProcessController.java, there is a possible unintended way to launch activities in the background due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0019 [HIGH] CWE-269 CVE-2026-0019: In SettingsLib, there is a possible way to disable system components due to a logic error in the cod In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-31336 [HIGH] CWE-787 CVE-2024-31336: In PVRSRVBridgeRGXKickTA3D2 of server_rgxta3d_bridge.c, there is a possible arbitrary code execution In PVRSRVBridgeRGXKickTA3D2 of server_rgxta3d_bridge.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-31333 [HIGH] CWE-190 CVE-2024-31333: In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer o In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-31334 [HIGH] CWE-269 CVE-2024-31334: In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution d In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0032 [HIGH] CWE-787 CVE-2026-0032: In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56982 [HIGH] CWE-693 CVE-2026-56982: In VPU, there is a possible permission bypass due to a missing permission check. This could lead to In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-35686 [HIGH] CVE-2023-35686: In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper in In PVRSRVRGXKickTA3DKM of rgxta3d.c, there is a possible arbitrary code execution due to improper input validation. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58695 [HIGH] CWE-120 CVE-2026-58695: In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escalation of privilege du In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58823 [HIGH] CWE-120 CVE-2026-58823: In stpropnci_process_std of stpropnci_std.cc, there is a possible memory safety issue due to a missi In stpropnci_process_std of stpropnci_std.cc, there is a possible memory safety issue due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-45531 [HIGH] CWE-122 CVE-2026-45531: In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-49884 [HIGH] CWE-120 CVE-2026-49884: In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect b In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-36928 [HIGH] CWE-120 CVE-2025-36928: In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to an incorrect bound In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-36930 [HIGH] CWE-120 CVE-2025-36930: In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds c In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-36927 [HIGH] CWE-120 CVE-2025-36927: In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to a mi In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-36932 [HIGH] CWE-20 CVE-2025-36932: In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory overwrite due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-32328 [HIGH] CVE-2025-32328: In multiple functions of Session.java, there is a possible way to view images belonging to a differe In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-32329 [HIGH] CVE-2025-32329: In multiple functions of Session.java, there is a possible way to view images belonging to a differe In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-32324 [HIGH] CWE-441 CVE-2025-32324: In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due In onCommand of ActivityManagerShellCommand.java, there is a possible arbitrary activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.