Google Android vulnerabilities

CVE-2023-40117 [HIGH] CWE-863 CVE-2023-40117: In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a perm In resetSettingsLocked of SettingsProvider.java, there is a possible lockscreen bypass due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9387 [HIGH] CWE-120 CVE-2018-9387: In multiple functions of mnh-sm.c, there is a possible way to trigger a heap overflow due to an inte In multiple functions of mnh-sm.c, there is a possible way to trigger a heap overflow due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-20409 [HIGH] CWE-787 CVE-2026-20409: In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to In imgsys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10363246; Issue ID: MSV-5779.

CVE-2026-20412 [HIGH] CWE-787 CVE-2026-20412: In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead In cameraisp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10351676; Issue ID: MSV-5733.

CVE-2026-20411 [HIGH] CWE-416 CVE-2026-20411: In cameraisp, there is a possible escalation of privilege due to use after free. This could lead to In cameraisp, there is a possible escalation of privilege due to use after free. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10351676; Issue ID: MSV-5737.

CVE-2023-21098 [HIGH] CWE-288 CVE-2023-21098: In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code i In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Androi

CVE-2025-26464 [HIGH] CWE-693 CVE-2025-26464: In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launc In executeAppFunction of AppSearchManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48522 [HIGH] CWE-693 CVE-2025-48522: In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM assoc In setDisplayName of AssociationRequest.java, there is a possible way for an app to retain CDM association due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-0079 [HIGH] CWE-250 CVE-2025-0079: In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted du In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40125 [HIGH] CVE-2023-40125: In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a p In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40141 [HIGH] CWE-787 CVE-2023-40141: In temp_residency_name_store of thermal_metrics.c, there is a possible out of bounds write due to a In temp_residency_name_store of thermal_metrics.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21241 [HIGH] CWE-190 CVE-2023-21241: In rw_i93_send_to_upper of rw_i93.cc, there is a possible out of bounds write due to an integer over In rw_i93_send_to_upper of rw_i93.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-49720 [HIGH] CWE-693 CVE-2024-49720: In multiple functions of Permissions.java, there is a possible way to override the state of the user In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48540 [HIGH] CWE-787 CVE-2025-48540: In processTransactInternal of RpcState.cpp, there is a possible local out of memory write due to a l In processTransactInternal of RpcState.cpp, there is a possible local out of memory write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9434 [HIGH] CWE-276 CVE-2018-9434: In multiple functions of Parcel.cpp, there is a possible way to bypass address space layout randomiz In multiple functions of Parcel.cpp, there is a possible way to bypass address space layout randomization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-43089 [HIGH] CWE-862 CVE-2024-43089: In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a In updateInternal of MediaProvider.java , there is a possible access of another app's files due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-40661 [HIGH] CWE-862 CVE-2024-40661: In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to acces In mayAdminGrantPermission of AdminRestrictedPermissionsUtils.java, there is a possible way to access the microphone due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21374 [HIGH] CWE-269 CVE-2023-21374: In System UI, there is a possible factory reset protection bypass due to a logic error in the code. In System UI, there is a possible factory reset protection bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26454 [HIGH] CWE-441 CVE-2025-26454: In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-32349 [HIGH] CWE-1021 CVE-2025-32349: In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. In multiple locations, there is a possible privilege escalation due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.