Google Android vulnerabilities

CVE-2025-48605 [HIGH] CWE-693 CVE-2025-48605: In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a l In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0038 [HIGH] CVE-2026-0038: In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a l In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48619 [HIGH] CWE-284 CVE-2025-48619: In multiple functions of ContentProvider.java, there is a possible way for an app with read-only acc In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0021 [HIGH] CWE-441 CVE-2026-0021: In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permissi In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0032 [HIGH] CWE-787 CVE-2026-0032: In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0047 [HIGH] CWE-280 CVE-2026-0047: In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access pri In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0020 [HIGH] CWE-639 CVE-2026-0020: In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent d In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48578 [HIGH] CWE-862 CVE-2025-48578: In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_ST In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2024-31328 [HIGH] CWE-693 CVE-2024-31328: In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitr In broadcastIntentLockedTraced of BroadcastController.java, there is a possible way to launch arbitrary activities from the background on the paired companion phone due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0017 [HIGH] CWE-285 CVE-2026-0017: In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48579 [HIGH] CWE-441 CVE-2025-48579: In multiple functions of MediaProvider.java, there is a possible external storage write permission b In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48645 [HIGH] CWE-269 CVE-2025-48645: In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper i In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48646 [HIGH] CWE-441 CVE-2025-48646: In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused dep In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.

CVE-2026-0010 [HIGH] CWE-787 CVE-2026-0010: In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bo In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48582 [HIGH] CWE-59 CVE-2025-48582: In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE p In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48577 [HIGH] CWE-362 CVE-2025-48577: In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a r In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-20416 [HIGH] CWE-787 CVE-2026-20416: In pcie, there is a possible out of bounds write due to a missing bounds check. This could lead to l In pcie, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10315038 / ALPS10340155; Issue ID: MSV-5155.

CVE-2025-48602 [HIGH] CWE-693 CVE-2025-48602: In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possib In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-48568 [HIGH] CWE-362 CVE-2025-48568: In multiple locations, there is a possible lockscreen bypass due to a race condition. This could lea In multiple locations, there is a possible lockscreen bypass due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2026-0026 [HIGH] CWE-862 CVE-2026-0026: In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any sy In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.