Google Android vulnerabilities

CVE-2025-48553 [HIGH] CVE-2025-48553: In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible DoS of a device adm In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible DoS of a device admin due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-20780 [HIGH] CWE-416 CVE-2025-20780: In display, there is a possible memory corruption due to use after free. This could lead to local es In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184061; Issue ID: MSV-4712.

CVE-2025-26444 [HIGH] CWE-693 CVE-2025-26444: In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the sys In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistant application when a user-selected assistant is forcibly stopped due to a logic error in the code. This could lead to local escalation of privilege where the default assistant app is automatically granted

CVE-2025-26458 [HIGH] CWE-693 CVE-2025-26458: In multiple functions of LocationProviderManager.java, there is a possible background activity launc In multiple functions of LocationProviderManager.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48606 [HIGH] CVE-2025-48606: In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden In preparePackage of InstallPackageHelper.java, there is a possible way for an app to appear hidden upon installation without a mechanism to uninstall it due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-32333 [HIGH] CWE-863 CVE-2025-32333: In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to In startSpaActivityForApp of SpaActivity.kt, there is a possible cross-user permission bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22434 [HIGH] CWE-693 CVE-2025-22434: In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2017-13323 [HIGH] CWE-190 CVE-2017-13323: In String16 of String16.cpp, there is a possible out of bounds write due to an integer overflow. Thi In String16 of String16.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege in an unprivileged process with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9366 [HIGH] CWE-190 CVE-2018-9366: In IMSA_Recv_Thread and VT_IMCB_Thread of ImsaClient.cpp and VideoTelephony.c, there is a possible o In IMSA_Recv_Thread and VT_IMCB_Thread of ImsaClient.cpp and VideoTelephony.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9372 [HIGH] CWE-787 CVE-2018-9372: In cmd_flash_mmc_sparse_img of dl_commands.c, there is a possible out of bounds write due to a missi In cmd_flash_mmc_sparse_img of dl_commands.c, there is a possible out of bounds write due to a missing bounds check. This could lead to a local escalation of privilege in the bootloader with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9367 [HIGH] CWE-787 CVE-2018-9367: In FT_ACDK_CCT_V2_OP_ISP_SET_TUNING_PARAS of Meta_CCAP_Para.cpp, there is a possible out of bounds w In FT_ACDK_CCT_V2_OP_ISP_SET_TUNING_PARAS of Meta_CCAP_Para.cpp, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9409 [HIGH] CWE-787 CVE-2018-9409: In HWCSession::SetColorModeById of hwc_session.cpp, there is a possible out of bounds write due to a In HWCSession::SetColorModeById of hwc_session.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-23710 [HIGH] CWE-269 CVE-2024-23710: In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execu In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privileged app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-32332 [HIGH] CWE-416 CVE-2025-32332: In multiple locations, there is a possible memory corruption due to a use after free. This could lea In multiple locations, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26431 [HIGH] CWE-693 CVE-2025-26431: In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enab In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9474 [HIGH] CWE-502 CVE-2018-9474: In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due In writeToParcel of MediaPlayer.java, there is a possible serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48573 [HIGH] CWE-250 CVE-2025-48573: In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS while-in-use abuse. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48563 [HIGH] CWE-453 CVE-2025-48563: In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-36905 [HIGH] CWE-693 CVE-2025-36905: In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic erro In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26439 [HIGH] CWE-693 CVE-2025-26439: In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious T In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to be enabled instead of the system component due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.