Platform Frameworks Base vulnerabilities

579 known vulnerabilities affecting platform/frameworks_base.

Total CVEs

579

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

UNKNOWN579

Vulnerabilities

SortPage 20 of 29

CVE-2026-0015P4UNKNOWN≥ 16-qpr2-next:0, < 16-qpr2-next:2026-03-01≥ 15:0, < 15:2026-03-01+3 more2026-03-01

CVE-2026-0015 CVE-2026-0015: In multiple locations of AppOpsService In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2023-21292P4UNKNOWN≥ 13-next:0, < 13-next:2023-08-01≥ 11:0, < 11:2023-08-01+3 more2023-08-01

CVE-2023-21292 CVE-2023-21292: In openContentUri of ActivityManagerService In openContentUri of ActivityManagerService.java, there is a possible way for a third party app to obtain restricted files due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2023-40139P4UNKNOWN≥ 15-next:0, < 15-next:2025-02-01≥ 12:0, < 12:2025-02-01+2 more2025-02-01

CVE-2023-40139 CVE-2023-40139: In FillUi of FillUi In FillUi of FillUi.java, there is a possible way to view other user's image due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2023-40124P4UNKNOWN≥ 14-next:0, < 14-next:2023-11-01≥ 11:0, < 11:2023-11-01+3 more2023-11-01

CVE-2023-40124 CVE-2023-40124: In multiple locations, there is a possible cross-user read due to a confused deputy In multiple locations, there is a possible cross-user read due to a confused deputy. This could lead to local information disclosure of photos or other images with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2023-21277P4UNKNOWN≥ 13-next:0, < 13-next:2023-08-01≥ 12:0, < 12:2023-08-01+2 more2023-08-01

CVE-2023-21277 CVE-2023-21277: In visitUris of RemoteViews In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2023-21279P4UNKNOWN≥ 13-next:0, < 13-next:2023-08-01≥ 12:0, < 12:2023-08-01+2 more2023-08-01

CVE-2023-21279 CVE-2023-21279: In visitUris of RemoteViews In visitUris of RemoteViews.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2023-21289P4UNKNOWN≥ 13-next:0, < 13-next:2023-08-01≥ 12:0, < 12:2023-08-01+2 more2023-08-01

CVE-2023-21289 CVE-2023-21289: In multiple locations, there is a possible bypass of a multi user security boundary due to a confused deputy In multiple locations, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2025-48584P4UNKNOWN≥ 16-qpr2-next:0, < 16-qpr2-next:2025-12-01≥ 16:0, < 16:2025-12-012025-12-01

CVE-2025-48584 CVE-2025-48584: In multiple functions of NotificationManagerService In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2023-21141P4UNKNOWN≥ 12:0, < 12:2023-06-01≥ 12L:0, < 12L:2023-06-012023-06-01

CVE-2023-21141 CVE-2023-21141: In several functions of several files, there is a possible way to access developer mode traces due to a permissions bypass In several functions of several files, there is a possible way to access developer mode traces due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2024-49733P4UNKNOWN≥ 15-next:0, < 15-next:2025-01-01≥ 12:0, < 12:2025-01-01+4 more2025-01-01

CVE-2024-49733 CVE-2024-49733: In reload of ServiceListing In reload of ServiceListing.java , there is a possible way to allow a malicious app to hide an NLS from Settings due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2025-48554P4UNKNOWN≥ 16-next:0, < 16-next:2025-09-01≥ 15:0, < 15:2025-09-01+3 more2025-09-01

CVE-2025-48554 CVE-2025-48554: In handlePackagesChanged of DevicePolicyManagerService In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.

osv

CVE-2025-26437P4UNKNOWN≥ 16-next:0, < 16-next:2025-06-01≥ 15:0, < 15:2025-06-012025-06-01

CVE-2025-26437 CVE-2025-26437: In CredentialManagerServiceStub of CredentialManagerService In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2025-48560P4UNKNOWN≥ 16-next:0, < 16-next:2025-09-01≥ 15:0, < 15:2025-09-01+1 more2025-09-01

CVE-2025-48560 CVE-2025-48560: In AndroidManifest In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2020-0454P4UNKNOWN≥ 9:0, < 9:2020-11-012020-11-01

CVE-2020-0454 CVE-2020-0454: In callCallbackForRequest of ConnectivityService In callCallbackForRequest of ConnectivityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure of the current SSID with User execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2025-0087P4UNKNOWN≥ 15-next:0, < 15-next:2025-05-01≥ 15:0, < 15:2025-05-01+2 more2025-05-01

CVE-2025-0087 CVE-2025-0087: In onCreate of UninstallerActivity In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2020-0249P4UNKNOWN≥ 8.0:0, < 8.0:2020-08-01≥ 8.1:0, < 8.1:2020-08-01+2 more2020-08-01

CVE-2020-0249 CVE-2020-0249: In postInstantAppNotif of InstantAppNotifier In postInstantAppNotif of InstantAppNotifier.java, there is a possible permission bypass due to a PendingIntent error. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2020-0467P4UNKNOWN≥ 8.1:0, < 8.1:2020-12-01≥ 9:0, < 9:2020-12-01+2 more2020-12-01

CVE-2020-0467 CVE-2020-0467: In onUserStopped of Vpn In onUserStopped of Vpn.java, there is a possible resetting of user preferences due to a logic issue. This could lead to local information disclosure of secure network traffic over a non-VPN link with no additional execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2021-0304P4UNKNOWN≥ 8.0:0, < 8.0:2021-01-01≥ 8.1:0, < 8.1:2021-01-01+2 more2021-01-01

CVE-2021-0304 CVE-2021-0304: In several functions of GlobalScreenshot In several functions of GlobalScreenshot.java, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of the user's contacts with User execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2020-0415P4UNKNOWN≥ 8.0:0, < 8.0:2020-10-01≥ 8.1:0, < 8.1:2020-10-01+3 more2020-10-01

CVE-2020-0415 CVE-2020-0415: In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent In various locations in SystemUI, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure of contact data with User execution privileges needed. User interaction is not needed for exploitation.

osv

CVE-2021-0309P4UNKNOWN≥ 8.0:0, < 8.0:2021-01-01≥ 8.1:0, < 8.1:2021-01-01+3 more2021-01-01

CVE-2021-0309 CVE-2021-0309: In onCreate of grantCredentialsPermissionActivity, there is a confused deputy In onCreate of grantCredentialsPermissionActivity, there is a confused deputy. This could lead to local information disclosure and account access with no additional execution privileges needed. User interaction is needed for exploitation.

osv

← Previous20 / 29Next →