Google Android vulnerabilities

CVE-2025-20706 [HIGH] CWE-416 CVE-2025-20706: In mbrain, there is a possible memory corruption due to use after free. This could lead to local esc In mbrain, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09924624; Issue ID: MSV-3826.

CVE-2025-20705 [HIGH] CWE-416 CVE-2025-20705: In monitor_hang, there is a possible memory corruption due to use after free. This could lead to loc In monitor_hang, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09989078; Issue ID: MSV-3964.

CVE-2025-0080 [HIGH] CWE-250 CVE-2025-0080: In multiple locations, there is a possible way to overlay the installation confirmation dialog due t In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9401 [HIGH] CWE-276 CVE-2018-9401: In many locations, there is a possible way to access kernel memory in user space due to an incorrect In many locations, there is a possible way to access kernel memory in user space due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-23704 [HIGH] CWE-862 CVE-2024-23704: In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONF In onCreate of WifiDialogActivity.java, there is a possible way to bypass the DISALLOW_ADD_WIFI_CONFIG restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48546 [HIGH] CWE-693 CVE-2025-48546: In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-20064 [HIGH] CWE-20 CVE-2024-20064: In wlan service, there is a possible out of bounds write due to improper input validation. This coul In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08572601; Issue ID: MSV-1229.

CVE-2024-29752 [HIGH] CWE-787 CVE-2024-29752: In tmu_set_tr_num_thresholds of tmu.c, there is a possible out of bounds write due to a missing boun In tmu_set_tr_num_thresholds of tmu.c, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21247 [HIGH] CWE-862 CVE-2023-21247: In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possibl In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21248 [HIGH] CWE-862 CVE-2023-21248: In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-32345 [HIGH] CWE-269 CVE-2025-32345: In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a se In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app scanning setting due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48523 [HIGH] CWE-863 CVE-2025-48523: In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permissio In onCreate of SelectAccountActivity.java, there is a possible way to add contacts without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-34737 [HIGH] CVE-2024-34737: In ensureSetPipAspectRatioQuotaTracker of ActivityClientController.java, there is a possible way to In ensureSetPipAspectRatioQuotaTracker of ActivityClientController.java, there is a possible way to generate unmovable and undeletable pip windows due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21145 [HIGH] CWE-326 CVE-2023-21145: In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launc In updatePictureInPictureMode of ActivityRecord.java, there is a possible bypass of background launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-53841 [HIGH] CWE-276 CVE-2024-53841: In startListeningForDeviceStateChanges, there is a possible Permission Bypass due to a confused depu In startListeningForDeviceStateChanges, there is a possible Permission Bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9339 [HIGH] CWE-843 CVE-2018-9339: In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of priv In writeTypedArrayList and readTypedArrayList of Parcel.java, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-32906 [HIGH] CWE-908 CVE-2024-32906: In AcvpOnMessage of avcp.cpp, there is a possible EOP due to uninitialized data. This could lead to In AcvpOnMessage of avcp.cpp, there is a possible EOP due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-32908 [HIGH] CWE-362 CVE-2024-32908: In sec_media_protect of media.c, there is a possible permission bypass due to a race condition. This In sec_media_protect of media.c, there is a possible permission bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21131 [HIGH] CWE-639 CVE-2023-21131: In checkKeyIntentParceledCorrectly() of ActivityManagerService.java, there is a possible bypass of P In checkKeyIntentParceledCorrectly() of ActivityManagerService.java, there is a possible bypass of Parcel Mismatch mitigations due to a logic error in the code. This could lead to local escalation of privilege and the ability to launch arbitrary activities in settings with no additional execution privileges needed. User interaction is not needed for e

CVE-2025-20797 [HIGH] CWE-121 CVE-2025-20797: In battery, there is a possible out of bounds write due to a missing bounds check. This could lead t In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10315812; Issue ID: MSV-5534.