Google Android vulnerabilities

CVE-2026-55266 [HIGH] CWE-400 CVE-2026-55266: In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaus In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-55286 [HIGH] CWE-119 CVE-2026-55286: In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bo In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-49880 [HIGH] CWE-119 CVE-2026-49880: In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0143 [HIGH] CWE-416 CVE-2026-0143: In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a u In lwis_device_external_event_emit of lwis_event.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0096 [HIGH] CWE-451 CVE-2026-0096: In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgettin In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48570 [HIGH] CWE-441 CVE-2025-48570: In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from t In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-32348 [HIGH] CWE-863 CVE-2025-32348: In multiple locations, there is a possible background activity launch due to a missing permission ch In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0036 [HIGH] CWE-1021 CVE-2026-0036: In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28625 [HIGH] CWE-269 CVE-2026-28625: In multiple locations, there is a possible permission bypass due to a logic error in the code. This In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0152 [HIGH] CWE-119 CVE-2026-0152: In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to In OSMMapPMRGeneric of pmr_os.c, there is a possible way to leverage a system call to system call to maliciously expand the VMA out of bounds due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0099 [HIGH] CWE-273 CVE-2026-0099: In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from th In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2026-55270 [HIGH] CWE-441 CVE-2026-55270: In dialInternal in multiple locations, there is a possible permission bypass due to a confused deput In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0153 [HIGH] CWE-787 CVE-2026-0153: In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bound In Write of msg_to_host_buffer.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0133 [HIGH] CWE-862 CVE-2026-0133: In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootc In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28577 [HIGH] CWE-1021 CVE-2026-28577: In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/ In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0089 [HIGH] CWE-269 CVE-2026-0089: In multiple functions of PackageInstallerService.java, there is a possible way to install unverified In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-58841 [HIGH] CWE-269 CVE-2026-58841: In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0094 [HIGH] CWE-451 CVE-2026-0094: In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into appr In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-28590 [HIGH] CWE-347 CVE-2026-28590: In multiple locations, there is a possible improper encryption key validation due to a logic error i In multiple locations, there is a possible improper encryption key validation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2019-20607 [CRITICAL] CWE-787 CVE-2019-20607: An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (MSM8996, MSM8998, An issue was discovered on Samsung mobile devices with N(7.x), O(8.x), and P(9.0) (MSM8996, MSM8998, Exynos7420, Exynos7870, Exynos8890, and Exynos8895 chipsets) software. A heap overflow in the keymaster Trustlet allows attackers to write to TEE memory, and achieve arbitrary code execution. The Samsung ID is SVE-2019-14126 (May 2019).