Google Android vulnerabilities

CVE-2023-21313 [HIGH] CWE-862 CVE-2023-21313: In Core, there is a possible way to forward calls without user knowledge due to a missing permission In Core, there is a possible way to forward calls without user knowledge due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2023-35667 [HIGH] CWE-269 CVE-2023-35667: In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notificat In updateList of NotificationAccessSettings.java, there is a possible way to hide approved notification listeners in the settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2022-20443 [HIGH] CWE-1021 CVE-2022-20443: In hasInputInfo of Layer.cpp, there is a possible bypass of user interaction requirements due to a t In hasInputInfo of Layer.cpp, there is a possible bypass of user interaction requirements due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-194480991

CVE-2023-21021 [HIGH] CWE-862 CVE-2023-21021: In isTargetSdkLessThanQOrPrivileged of WifiServiceImpl.java, there is a possible way for the guest u In isTargetSdkLessThanQOrPrivileged of WifiServiceImpl.java, there is a possible way for the guest user to change admin user network settings due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Andro

CVE-2023-21107 [HIGH] CWE-276 CVE-2023-21107: In retrieveAppEntry of NotificationAccessDetails.java, there is a missing permission check. This cou In retrieveAppEntry of NotificationAccessDetails.java, there is a missing permission check. This could lead to local escalation of privilege across user boundaries with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-259385017

CVE-2023-20655 [HIGH] CWE-269 CVE-2023-20655: In mmsdk, there is a possible escalation of privilege due to a parcel format mismatch. This could le In mmsdk, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07203022; Issue ID: ALPS07203022.

CVE-2023-40107 [HIGH] CWE-416 CVE-2023-40107: In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-20979 [HIGH] CWE-787 CVE-2025-20979: Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary co Out-of-bounds write in libsavscmn prior to Android 15 allows local attackers to execute arbitrary code.

CVE-2023-21117 [HIGH] CWE-863 CVE-2023-21117: In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated In registerReceiverWithFeature of ActivityManagerService.java, there is a possible way for isolated processes to register a broadcast receiver due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13A

CVE-2024-20092 [HIGH] CWE-787 CVE-2024-20092: In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to l In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS09028313; Issue ID: MSV-1700.

CVE-2023-35692 [HIGH] CWE-273 CVE-2023-35692: In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an e In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an emergency call due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2018-9428 [HIGH] CWE-416 CVE-2018-9428: In startDevice of AAudioServiceStreamBase.cpp there is a possible out of bounds write due to a use a In startDevice of AAudioServiceStreamBase.cpp there is a possible out of bounds write due to a use after free. This could lead to local arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation. https://source.android.com/security/bulletin/2018-07-01

CVE-2024-34738 [HIGH] CWE-266 CVE-2024-34738: In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read t In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-27233 [HIGH] CWE-269 CVE-2024-27233: In ppcfw_init_secpolicy of ppcfw.c, there is a possible permission bypass due to uninitialized data. In ppcfw_init_secpolicy of ppcfw.c, there is a possible permission bypass due to uninitialized data. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-20763 [HIGH] CWE-787 CVE-2025-20763: In mmdvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to In mmdvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10267218; Issue ID: MSV-5032.

CVE-2025-20764 [HIGH] CWE-787 CVE-2025-20764: In smi, there is a possible out of bounds write due to a missing bounds check. This could lead to lo In smi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10259774; Issue ID: MSV-5029.

CVE-2024-27222 [HIGH] CWE-269 CVE-2024-27222: In onSkipButtonClick of FaceEnrollFoldPage.java, there is a possible way to access the file the app In onSkipButtonClick of FaceEnrollFoldPage.java, there is a possible way to access the file the app cannot access due to Intent Redirect GRANT_URI_PERMISSIONS Attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2025-22418 [HIGH] CWE-441 CVE-2025-22418: In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead t In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVE-2024-39435 [HIGH] CVE-2024-39435: In Logmanager service, there is a possible missing verification incorrect input. This could lead to In Logmanager service, there is a possible missing verification incorrect input. This could lead to local escalation of privilege with no additional execution privileges needed.

CVE-2024-32919 [HIGH] CWE-843 CVE-2024-32919: In lwis_add_completion_fence of lwis_fence.c, there is a possible escalation of privilege due to typ In lwis_add_completion_fence of lwis_fence.c, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.