Google Android vulnerabilities

CVE-2026-28602 [HIGH] CWE-284 CVE-2026-28602: In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult- In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28620 [HIGH] CWE-863 CVE-2026-28620: In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28607 [HIGH] CWE-441 CVE-2026-28607: In multiple functions in multiple locations, there is a possible background activity launch bypass d In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0023 [HIGH] CWE-269 CVE-2026-0023: In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to upda In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9368 [HIGH] CWE-787 CVE-2018-9368: In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check In mtkscoaudio debugfs there is a possible arbitrary kernel memory write due to missing bounds check and weakened SELinux policies. This could lead to local escalation of privilege with system execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-56945 [HIGH] CWE-441 CVE-2026-56945: In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local e In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28611 [HIGH] CWE-862 CVE-2026-28611: In multiple functions of NfcService.java, there is a possible silent payment session hijacking enabl In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28624 [HIGH] CWE-441 CVE-2026-28624: In multiple locations, there is a possible read/write access to files without the proper permissions In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28616 [HIGH] CWE-441 CVE-2026-28616: In Setup Wizard, there is a possible way to force connection to a malicious network due to confused In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58874 [HIGH] CWE-269 CVE-2026-58874: In multiple functions of SmsController.java, there is a possible escalation of privilege due to a mi In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28657 [HIGH] CWE-441 CVE-2026-28657: In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permi In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28572 [HIGH] CWE-601 CVE-2026-28572: In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attac In onCreate of InstallLaunch.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48586 [HIGH] CWE-441 CVE-2025-48586: In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21165 [HIGH] CWE-416 CVE-2023-21165: In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a us In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0009 [HIGH] CWE-269 CVE-2026-0009: In multiple locations, there is a possible tapjacking due to a logic error in the code. This could l In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48541 [HIGH] CWE-20 CVE-2025-48541: In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user pro In onCreate of FaceSettings.java, there is a possible way to remove biometric unlock across user profiles due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48536 [HIGH] CWE-441 CVE-2025-48536: In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a t In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48627 [HIGH] CVE-2025-48627: In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to launch a In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22426 [HIGH] CWE-284 CVE-2025-22426: In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-36906 [HIGH] CWE-122 CVE-2025-36906: In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.