Google Android vulnerabilities

CVE-2025-20798 [HIGH] CWE-787 CVE-2025-20798: In battery, there is a possible out of bounds write due to a missing bounds check. This could lead t In battery, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10315812; Issue ID: MSV-5533.

CVE-2025-20795 [HIGH] CWE-787 CVE-2025-20795: In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lea In KeyInstall, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10276761; Issue ID: MSV-5141.

CVE-2025-26436 [HIGH] CWE-863 CVE-2025-26436: In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an applicatio In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26440 [HIGH] CWE-862 CVE-2025-26440: In multiple functions of CameraService.cpp, there is a possible way to use the camera from the backg In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-22012 [HIGH] CWE-787 CVE-2024-22012: there is a possible out of bounds write due to a missing bounds check. This could lead to local esca there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21270 [HIGH] CWE-863 CVE-2023-21270: In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app t In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way for an app to keep permissions that should be revoked due to incorrect permission flags cleared during an update. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-27221 [HIGH] CWE-787 CVE-2024-27221: In update_policy_data of , there is a possible out of bounds write due to a missing bounds check. Th In update_policy_data of , there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-36898 [HIGH] CWE-693 CVE-2025-36898: There is a possible escalation of privilege due to a logic error in the code. This could lead to loc There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-20778 [HIGH] CWE-787 CVE-2025-20778: In display, there is a possible out of bounds write due to a missing bounds check. This could lead t In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10184870; Issue ID: MSV-4729.

CVE-2025-48555 [HIGH] CWE-441 CVE-2025-48555: In multiple functions of NotificationStation.java, there is a possible cross-profile information dis In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-20768 [HIGH] CWE-125 CVE-2025-20768: In display, there is a possible out of bounds read due to a missing bounds check. This could lead to In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10196993; Issue ID: MSV-4805.

CVE-2025-32350 [HIGH] CWE-1021 CVE-2025-32350: In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsS In maybeShowDialog of ControlsSettingsDialogManager.kt, there is a possible overlay of the ControlsSettingsDialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-34734 [HIGH] CWE-1188 CVE-2024-34734: In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app from the lockscreen due to an insecure default value. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-21126 [HIGH] CWE-276 CVE-2023-21126: In bindOutputSwitcherAndBroadcastButton of MediaControlPanel.java, there is a possible launch arbitr In bindOutputSwitcherAndBroadcastButton of MediaControlPanel.java, there is a possible launch arbitrary activity under SysUI due to Unsafe Intent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-271846393

CVE-2024-34736 [HIGH] CVE-2024-34736: In setupVideoEncoder of StagefrightRecorder.cpp, there is a possible asynchronous playback when B-fr In setupVideoEncoder of StagefrightRecorder.cpp, there is a possible asynchronous playback when B-frame support is enabled. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40106 [HIGH] CWE-269 CVE-2023-40106: In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity fro In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26462 [HIGH] CWE-269 CVE-2025-26462: In AccessibilityServiceConnection.java, there is a possible background activity launch due to a logi In AccessibilityServiceConnection.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26430 [HIGH] CWE-285 CVE-2025-26430: In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-26435 [HIGH] CWE-269 CVE-2025-26435: In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a se In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's deceptive app scanning setting due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-40132 [HIGH] CWE-276 CVE-2023-40132: In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content pr In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.