Google Android
1505 vulnérabilités publiées citent ce produit. Les 200 plus récentes sont listées.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-56952 | Android kernel | In platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due to a missing permission check. This could | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-56936 | Android kernel | In wacom_hid_set_device_mode of wacom_sys.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to physi | MEDIUM 6.8 | 0.1 % | ||
| CVE-2026-56906 | Android kernel | In ep_free of eventpoll.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with | HIGH 7.0 | 0.1 % | ||
| CVE-2026-55330 | Android kernel | In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code. This could lead | CRITICAL 9.8 | 0.3 % | ||
| CVE-2026-55307 | Android kernel | In kdn_set_sysregs_prot of hwcrypto-kdn.c, there is a possible information disclosure due to a logic error in the code. This could lead to l | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-0198 | Android kernel | In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-28648 | 16-qpr2 ; 16 ; 15 ; … | In Settings, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additi | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28647 | 16-qpr2 ; 15 ; 14 | In updateState of DeviceAdminAppsPreferenceController.java, there is a possible permission bypass due to a logic error in the code. This cou | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28641 | 16-qpr2 ; 15 ; 14 | In shouldDisableUninstallButton of ApplicationActionButtonsPreferenceController.java, there is a possible permission bypass due to a logic e | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28640 | 16 ; 15 ; 14 | In checkCallerIsCertInstallerOrSelfInProfile of CredentialStorageActivity.java, there is a possible permission bypass due to improper input | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28625 | 17 ; 16-qpr2 ; 16 ; … | In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privil | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58880 | 17 ; 16-qpr2 ; 16 | In handle_app_val_response of btif_rc.cc, there is a possible way to achieve code execution due to a race condition. This could lead to loca | HIGH 7.0 | 0.1 % | ||
| CVE-2026-58865 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of PduParser.java, there is a possible persistent denial of service due to a missing bounds check. This could lead to | HIGH 7.5 | 0.2 % | ||
| CVE-2026-58859 | 17 | In multiple places, there is a possible denial of service due to an uncaught exception. This could lead to local escalation of privilege wi | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58856 | 17 ; 16-qpr2 ; 16 ; … | In returnOutputBufferLocked of DeprecatedCamera3StreamSplitter.cpp, there is a possible out-of-bounds read due to a missing bounds check. Th | LOW 3.3 | 0.1 % | ||
| CVE-2026-58854 | 17 ; 16-qpr2 ; 16 ; … | In multiple locations, there is a possible memory corruption due to type confusion. This could lead to local escalation of privilege with no | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58841 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of VirtualAudioControllerTest.java, there is a possible permission bypass due to a logic error in the code. This could | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58835 | 17 ; 16-qpr2 ; 16 | In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execut | HIGH 8.8 | 0.2 % | ||
| CVE-2026-58834 | 17 ; 16-qpr2 ; 16 ; … | In setPermissionGrantState of DevicePolicyManagerService.java, there is a possible persistent denial of service due to improper input valida | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-58815 | 17 ; 16-qpr2 ; 16 ; … | In multiple locations, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of priv | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55286 | 17 | In stpropnci_process of stpropnci.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local esc | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55280 | 17 ; 16-qpr2 ; 16 | In multiple locations, there is a possible out-of-bounds write due to uninitialized data. This could lead to remote escalation of privilege | HIGH 8.8 | 0.2 % | ||
| CVE-2026-55270 | 17 ; 16-qpr2 ; 16 ; … | In dialInternal in multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation o | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55269 | 17 ; 16-qpr2 ; 16 | In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to loc | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55266 | 17 ; 16-qpr2 ; 16 ; … | In qsort of libufdt_sysdeps_vendor.c, there is a possible out-of-bounds write due to resource exhaustion. This could lead to local escalatio | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55265 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of PduParser.java, there is a possible out of bounds read due to a missing bounds check. This could lead to a remote d | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-49937 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of MessageQueueBase.h, there is a possible out of bounds read due to an incorrect bounds check. This could lead to loc | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49933 | 17 ; 16-qpr2 ; 16 | In handle_le_monitor_device_event of msft.cc, there is a possible control-flow hijack in the privileged bluetooth process due to an uninitia | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49885 | 17 ; 16-qpr2 ; 16 ; … | In rw_t4t_update_file of rw_t4t.cc, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49880 | 17 ; 16-qpr2 ; 16 | In multiple functions of nfa_nfcee_act.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local e | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49878 | 17 ; 16-qpr2 ; 16 ; … | In wpas_handle_robust_av_scs_recv_action of robust_av.c, there is a possible out-of-bounds write due to a logic error in the code. This coul | HIGH 7.2 | 0.3 % | ||
| CVE-2026-45524 | 17 | In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local esca | HIGH 8.8 | 0.1 % | ||
| CVE-2026-28667 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of rw_t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local informati | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-58773 | Android kernel | In link_load_gnss_image of link_device.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local es | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58767 | Android kernel | In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to loc | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58766 | Android kernel | In multiple functions of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to loc | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58765 | Android kernel | In GPU, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with System | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58755 | Android kernel | In smmu_install_nested_ste of arm-smmu-v3.c, there is a possible escalation of privilege due to a logic error in the code. This could lead t | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58751 | Android kernel | In multiple functions of arm-smmu-v3.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escala | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58747 | Android kernel | In smmu_detach_dev of arm-smmu-v3.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escala | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58744 | Android kernel | In multiple locations, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58739 | Android kernel | In platform_msg_handler_init of default_msg_handlers.c, there is a possible confused deputy due to a confused deputy. This could lead to loc | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58734 | Android kernel | In google_mba_recv_msg of google_mba_poll.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escal | HIGH 7.0 | 0.1 % | ||
| CVE-2026-58731 | Android kernel | In multiple functions of physmem_extmem_linux.c, there is a possible out-of-bounds read due to uninitialized data. This could lead to local | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-58728 | Android kernel | In ARM64_TLBI of mmu.h, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with | HIGH 7.0 | 0.1 % | ||
| CVE-2026-58726 | Android kernel | In FsmReleaseKey of fsm.c, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of p | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58724 | Android kernel | In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with Sys | HIGH 7.0 | 0.1 % | ||
| CVE-2026-58721 | Android kernel | In multiple locations, there is a possible information disclosure due to uninitialized memory use. This could lead to local information disc | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-58718 | Android kernel | In smmu_detach_dev_nested of arm-smmu-v3.c, there is a possible escalation of privilege due to improper input validation. This could lead to | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58716 | Android kernel | In multiple locations, there is a possible time-of-check to time-of-use due to a race condition. This could lead to local escalation of priv | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58710 | Android kernel | In DecodeFilmGrainParams of film_grain_dec.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to rem | HIGH 8.8 | 0.4 % | ||
| CVE-2026-58704 | Android kernel | In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) esc | HIGH 8.8 | 0.6 % | KEV | |
| CVE-2026-58701 | Android kernel | In trusty_dputc of generic-arm64-smcall.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalat | HIGH 7.0 | 0.1 % | ||
| CVE-2026-58699 | Android kernel | In Vp9DecEndOfStream of vp9hwd_output.cc, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local | HIGH 8.4 | 0.1 % | ||
| CVE-2026-58698 | Android kernel | In ap_pmic_poll_msg_handler of ap_pmic_ipc.c, there is a possible permission bypass due to a confused deputy. This could lead to local escal | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-58695 | Android kernel | In gmc_phy_lp3_exit_restore_registers of phy_power.c, there is a possible escalation of privilege due to a missing bounds check. This could | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58691 | Android kernel | In FsmReleaseKey of fsm.c, there is a possible permission bypass due to improper input validation. This could lead to local escalation of pr | HIGH 8.4 | 0.1 % | ||
| CVE-2026-58683 | Android kernel | In IP Multimedia Subsystem, there is a possible out-of-bounds write due to improper input validation. This could lead to remote code executi | HIGH 8.8 | 0.4 % | ||
| CVE-2026-58679 | Android kernel | In gf_ta_test_set_config of gf_ta_test.c, there is a possible heap buffer overflow due to a logic error in the code. This could lead to loca | HIGH 8.4 | 0.1 % | ||
| CVE-2026-58678 | Android kernel | In Bootloader, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege with | HIGH 7.8 | 0.1 % | ||
| CVE-2026-57042 | Android kernel | In multiple functions of DreamPickerReceiver.kt, there is a possible permission bypass due to a confused deputy. This could lead to local es | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-57035 | Android kernel | In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privile | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-57014 | Android kernel | In phNxpNciHal_ext_process_nfc_init_rsp of phNxpNciHal_ext.cc, there is a possible out-of-bounds write due to a missing bounds check. This c | HIGH 7.8 | 0.1 % | ||
| CVE-2026-57012 | Android kernel | In the Setup Wizard, there is a possible remote package install due to a missing permission check. This could lead to remote escalation of p | HIGH 8.4 | 0.1 % | ||
| CVE-2026-57008 | Android kernel | In Modem, there is a possible information disclosure due to improper input validation. This could lead to remote information disclosure with | HIGH 7.5 | 0.3 % | ||
| CVE-2026-57006 | Android kernel | In acfw_ffa.c, there is a possible secret read due to a logic error in the code. This could lead to local information disclosure with System | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-56997 | Android kernel | In Av1DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote | HIGH 8.8 | 0.4 % | ||
| CVE-2026-56992 | Android kernel | In multiple files, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with Sys | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-56989 | Android kernel | In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privile | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-56988 | Android kernel | In multiple functions of bluetooth_cco.cc, there is a possible use-after-free due to a race condition. This could lead to local escalation o | MEDIUM 6.4 | 0.1 % | ||
| CVE-2026-56986 | Android kernel | In multiple files, there is a possible out-of-bounds read due to type confusion. This could lead to local escalation of privilege with no ad | HIGH 8.4 | 0.1 % | ||
| CVE-2026-56985 | Android kernel | In multiple files, there is a possible way to obtain signatures due to type confusion. This could lead to local escalation of privilege with | HIGH 8.4 | 0.1 % | ||
| CVE-2026-56982 | Android kernel | In VPU, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with Syste | HIGH 7.8 | 0.1 % | ||
| CVE-2026-56979 | Android kernel | In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privil | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-56978 | Android kernel | In get_global_config_item_addr of gc.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local escal | HIGH 8.4 | 0.1 % | ||
| CVE-2026-56975 | Android kernel | In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote (proximal/adjacent) den | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-56974 | Android kernel | In Start of AudioRtpPayloadEncoderNode.cpp, there is a possible out-of-bounds write due to improper input validation. This could lead to rem | HIGH 8.8 | 0.4 % | ||
| CVE-2026-56973 | Android kernel | In multiple locations, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-56972 | Android kernel | In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalation of priv | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-56970 | Android kernel | In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privi | HIGH 8.4 | 0.1 % | ||
| CVE-2026-56967 | Android kernel | In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote (proximal/adjacent) code | HIGH 8.0 | 0.2 % | ||
| CVE-2026-56964 | Android kernel | In multiple locations, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with Sys | MEDIUM 6.4 | 0.1 % | ||
| CVE-2026-56960 | Android kernel | In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to remote escalation of privileg | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-56958 | Android kernel | In gf_algo_get_cached_dump_data of gf_algo.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-56950 | Android kernel | In validate_ns_buf of mbu_class.rs, there is a possible information disclosure due to improper input validation. This could lead to local in | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-56945 | Android kernel | In VPU, there is a possible out-of-bounds write due to a confused deputy. This could lead to local escalation of privilege with no additiona | HIGH 7.8 | 0.1 % | ||
| CVE-2026-56942 | Android kernel | In ReadTileInfo of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote escal | HIGH 8.8 | 0.4 % | ||
| CVE-2026-56941 | Android kernel | In multiple functions of fpc_tee_hal.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escala | HIGH 8.4 | 0.1 % | ||
| CVE-2026-56932 | Android kernel | In Trusted Execution Environment, there is a possible memory corruption due to improper input validation. This could lead to local escalatio | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-56923 | Android kernel | In handle_unmap_req of tipc_virtio_dev.c, there is a possible memory corruption due to a race condition. This could lead to local escalation | MEDIUM 6.4 | 0.1 % | ||
| CVE-2026-56922 | Android kernel | In CPM, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with System executi | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-56920 | Android kernel | In s_decode_vui_param of fw_hevc_dec_header.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to | HIGH 8.8 | 0.4 % | ||
| CVE-2026-56915 | Android kernel | In bigo_worker_thread of bigo.c, there is a possible escalation of privilege due to a race condition. This could lead to local escalation of | MEDIUM 6.4 | 0.1 % | ||
| CVE-2026-56914 | Android kernel | In multiple locations, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege with no | HIGH 8.4 | 0.1 % | ||
| CVE-2026-56907 | Android kernel | In VPU, there is a possible shared memory overwrite due to improper input validation. This could lead to local escalation of privilege with | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-56892 | Android kernel | In ReadDataElement of common.c, there is a possible information disclosure due to an incorrect bounds check. This could lead to local inform | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-56889 | Android kernel | In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege wi | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-56888 | Android kernel | In multiple locations, there is a possible permission bypass due to side channel information disclosure. This could lead to local escalation | MEDIUM 6.2 | 0.1 % | ||
| CVE-2026-56882 | Android kernel | In Cellular Modem, there is a possible information disclosure due to a logic error in the code. This could lead to remote code execution wit | HIGH 8.8 | 0.4 % | ||
| CVE-2026-56881 | Android kernel | In enable_segment of remap.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of | HIGH 8.4 | 0.1 % | ||
| CVE-2026-56879 | Android kernel | In gmc_mb_msg_handler of gmc_mba.c, there is a possible memory corruption due to a confused deputy. This could lead to local escalation of p | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-55366 | Android kernel | In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code. This could lead to remote escalation | CRITICAL 9.8 | 0.5 % | ||
| CVE-2026-55365 | Android kernel | In multiple functions of remap.c, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to local escalat | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-55359 | Android kernel | In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privil | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55351 | Android kernel | In VPU, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additio | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55343 | Android kernel | In decodeAmr of ImsMediaAudioPlayer.cpp, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote co | HIGH 8.0 | 0.3 % | ||
| CVE-2026-55332 | Android kernel | In multiple locations, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of priv | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-55331 | Android kernel | In IP Multimedia Subsystem, there is a possible out-of-bounds write due to an incorrect bounds check. This could lead to remote code executi | HIGH 8.8 | 0.4 % | ||
| CVE-2026-55323 | Android kernel | In gf_base_update_finger_base of gf_base.c, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to local | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55318 | Android kernel | In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no addition | HIGH 8.8 | 0.3 % | ||
| CVE-2026-55317 | Android kernel | In printf of printf.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of priv | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-55306 | Android kernel | In Cellular Modem, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with | HIGH 7.5 | 0.4 % | ||
| CVE-2026-55304 | Android kernel | In addr_remap_address_map of remap.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-55302 | Android kernel | In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privil | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-55301 | Android kernel | In Wave6VpuDecFlush of wave6.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation o | HIGH 8.4 | 0.1 % | ||
| CVE-2026-0200 | Android kernel | In Cellular Modem, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege | HIGH 8.8 | 0.4 % | ||
| CVE-2026-0199 | Android kernel | In gf_ta_test_set_config of gf_ta_test.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local | HIGH 7.8 | 0.1 % | ||
| CVE-2026-0197 | Android kernel | In VPU, there is a possible information dislclosure due to a logic error in the code. This could lead to local information disclosure with S | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-0194 | Android kernel | In multiple locations, there is a possible permission bypass due to an integer overflow. This could lead to local escalation of privilege wi | HIGH 8.4 | 0.1 % | ||
| CVE-2026-0192 | Android kernel | In Bootloader, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privile | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-0189 | Android kernel | In ac_init_policy of init.c, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of | HIGH 8.4 | 0.1 % | ||
| CVE-2026-0187 | Android kernel | In gsa_sw_pk_hash_compare of image-auth-srv.c, there is a possible escalation of privilege due to a logic error in the code. This could lead | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-0186 | Android kernel | In ac_init_one_sswrp of init.c, there is a possible escalation of privilege due to a logic error in the code. This could lead to local escal | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-0183 | Android kernel | In CPM, there is a possible information disclosure due to a confused deputy. This could lead to local information disclosure with System exe | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-0179 | Android kernel | In Bootloader, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege wit | MEDIUM 6.7 | 0.1 % | ||
| CVE-2026-0177 | Android kernel | In do_sss_aes_gcm_256_op of crypto-aes.c, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local inf | MEDIUM 4.4 | 0.1 % | ||
| CVE-2026-0171 | Android kernel | In multiple locations, there is a possible out-of-bounds write due to a logic error in the code. This could lead to remote code execution wi | HIGH 8.8 | 0.4 % | ||
| CVE-2026-0170 | Android kernel | In Vp9DecodeFrameTag of vp9hwd_headers.cc, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote | HIGH 8.8 | 0.4 % | ||
| CVE-2026-0159 | Android kernel | In Cellular Modem, there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote code execution with no a | HIGH 8.8 | 0.4 % | ||
| CVE-2026-58941 | Android kernel | In multiple functions of iommu.c, there is a possible out of bounds read/write due to improper input validation. This could lead to local es | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58874 | 16-qpr2 ; 16 ; 15 ; … | In multiple functions of SmsController.java, there is a possible escalation of privilege due to a missing permission check. This could lead | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58848 | Android kernel | In multiple functions of alloc.c, there is a possible unauthorized read/write access due to a race condition. This could lead to local escal | HIGH 7.0 | 0.1 % | ||
| CVE-2026-58846 | Android kernel | In kvm_iommu_map_sg of iommu.c, there is a possible use after free due to a missing permission check. This could lead to local escalation of | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58839 | 16-qpr2 ; 16 ; 15 ; … | In forEachLine of MountRegistry.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local escalation of | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58823 | 17 | In stpropnci_process_std of stpropnci_std.cc, there is a possible memory safety issue due to a missing bounds check. This could lead to loca | HIGH 7.8 | 0.1 % | ||
| CVE-2026-58822 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting. This could lead to remote code executi | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-58820 | 17 ; 16-qpr2 ; 16 | In multiple locations, there is a possible memory safety issue due to integer overflow. This could lead to local escalation of privilege wit | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55294 | 17 ; 16-qpr2 ; 16 ; … | In ihevcd_get_tu_data_size of ihevcd_utils.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to loca | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55290 | 17 ; 16-qpr2 ; 16 ; … | In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local informati | LOW 3.3 | 0.1 % | ||
| CVE-2026-55285 | 17 ; 16-qpr2 ; 16 | In openLogicalChannel of multiple files, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local esc | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55277 | 17 ; 16-qpr2 | In checkUiccListenConfigNeeded of RoutingManager.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead | HIGH 8.0 | 0.2 % | ||
| CVE-2026-55273 | 17 ; 16-qpr2 ; 16 | In AppendCommentLine of AnnotationProcessor.cpp, there is a possible supply chain risk due to improper input validation. This could lead to | HIGH 7.8 | 0.1 % | ||
| CVE-2026-55256 | 17 ; 16-qpr2 ; 16 ; … | In parsePartHeaders of multiple files, there is a possible persistent denial of service due to improper input validation. This could lead to | MEDIUM 6.5 | 0.3 % | ||
| CVE-2026-49932 | 17 ; 16-qpr2 ; 16 ; … | In parseParts of PduParser.java, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation o | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49927 | 17 ; 16-qpr2 | In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49921 | 17 ; 16-qpr2 ; 16 ; … | In multiple locations, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code execution with | CRITICAL 9.8 | 0.4 % | ||
| CVE-2026-49919 | 17 ; 16-qpr2 ; 16 ; … | In tt_face_colr_blend_layer of ttcolr.c, there is a possible remote code execution due to an integer overflow. This could lead to local esca | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49918 | 17 ; 16-qpr2 | In multiple functions, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49895 | 17 ; 16-qpr2 ; 16 ; … | In get_eht_operation_channel_width of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check. This cou | LOW 3.5 | 0.1 % | ||
| CVE-2026-49887 | 17 ; 16-qpr2 | In maybeRemoveInvalidInstallerPackageName of InstallRepository.kt, there is a possible unauthorized app update due to a permissions bypass. | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49884 | 17 ; 16-qpr2 ; 16 ; … | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local es | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49882 | 17 ; 16-qpr2 ; 16 ; … | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible memory safety issue due to a heap buffer overflow. This could lead to remote code | HIGH 8.8 | 0.4 % | ||
| CVE-2026-49881 | 17 | In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could le | HIGH 7.8 | 0.1 % | ||
| CVE-2026-49879 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execu | HIGH 8.8 | 0.4 % | ||
| CVE-2026-45531 | 17 ; 16-qpr2 ; 16 ; … | In read_boot_region of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of | HIGH 7.8 | 0.1 % | ||
| CVE-2026-45528 | 17 ; 16-qpr2 ; 16 ; … | In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This | HIGH 7.3 | 0.1 % | ||
| CVE-2026-45527 | 17 ; 16-qpr2 ; 16 ; … | In convertCleanApertureToRect of HeifCleanAperture.cpp, there is a possible way to cause a temporary denial of service due to an integer ove | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-45525 | 17 ; 16-qpr2 ; 16 ; … | In multiple locations, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information | LOW 3.3 | 0.1 % | ||
| CVE-2026-45521 | 17 ; 16-qpr2 ; 16 ; … | In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local in | LOW 3.3 | 0.1 % | ||
| CVE-2026-45520 | 17 ; 16-qpr2 ; 16 ; … | In onAttach of BiometricsSettingsBase.java, there is a possible authentication bypass due to a confused deputy. This could lead to local esc | HIGH 7.8 | 0.1 % | ||
| CVE-2026-45519 | 17 ; 16-qpr2 ; 16 ; … | In screenArgsForPermissionCheckIfAny of multiple locations there is a possible risk of unauthorized access due to a confused deputy. This co | LOW 3.3 | 0.1 % | ||
| CVE-2026-45515 | 17 ; 16-qpr2 ; 16 ; … | In a2dp_vendor_opus_decoder_decode_packet of a2dp_vendor_opus_decoder.cc, there is a possible out of bounds write due to a heap buffer overf | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28671 | 17 ; 16-qpr2 ; 16 ; … | In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition. This could lead to local info | LOW 3.3 | 0.1 % | ||
| CVE-2026-28668 | 17 ; 16-qpr2 ; 16 ; … | In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalatio | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28666 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG image rendering check | HIGH 8.8 | 0.3 % | ||
| CVE-2026-28664 | 17 ; 16-qpr2 ; 16 ; … | In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escal | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28663 | 17 ; 16-qpr2 ; 16 | In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL Bypass | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28662 | 17 ; 16-qpr2 ; 16 | In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead t | HIGH 8.0 | 0.2 % | ||
| CVE-2026-28660 | 17 ; 16-qpr2 ; 16 ; … | In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local informat | LOW 3.3 | 0.1 % | ||
| CVE-2026-28658 | 17 ; 16-qpr2 ; 16 ; … | In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28657 | 17 ; 16-qpr2 | In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. Th | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28656 | 16 ; 14 | In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to l | HIGH 7.3 | 0.1 % | ||
| CVE-2026-28655 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This coul | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28653 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28652 | 17 ; 16-qpr2 ; 16 | In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote info | LOW 3.1 | 0.2 % | ||
| CVE-2026-28650 | 17 ; 16-qpr2 ; 16 ; … | In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to loca | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28644 | 16-qpr2 ; 16 ; 15 ; … | In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy. This could | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28642 | 16-qpr2 ; 16 ; 15 ; … | In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28639 | 17 ; 16-qpr2 ; 16 ; … | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local es | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28638 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lea | LOW 3.3 | 0.1 % | ||
| CVE-2026-28636 | 16-qpr2 ; 16 ; 15 ; … | In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28634 | 17 ; 16-qpr2 ; 16 ; … | In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error i | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28633 | 17 ; 16-qpr2 ; 16 ; … | In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-28631 | 17 ; 16-qpr2 ; 16 ; … | In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28630 | 17 | In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local inf | LOW 3.3 | 0.1 % | ||
| CVE-2026-28627 | 17 ; 16-qpr2 | In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote in | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-28626 | 17 ; 16-qpr2 ; 16 ; … | In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could le | HIGH 7.3 | 0.1 % | ||
| CVE-2026-28624 | 17 ; 16-qpr2 ; 16 | In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could le | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28623 | 17 ; 16-qpr2 ; 16 | In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission | LOW 3.3 | 0.1 % | ||
| CVE-2026-28622 | 17 | In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This co | LOW 3.3 | 0.1 % | ||
| CVE-2026-28620 | 17 ; 16-qpr2 ; 16 | In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privi | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28618 | 17 ; 16-qpr2 ; 16 | In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow. This could lead to remote code execution with no | HIGH 8.8 | 0.4 % | ||
| CVE-2026-28617 | 17 ; 16-qpr2 ; 16 ; … | In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion. This could lead to local denial | MEDIUM 5.5 | 0.1 % | ||
| CVE-2026-28616 | Android SoC | In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalat | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28614 | 17 ; 16-qpr2 ; 16 ; … | In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy. This could lead to local escala | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28613 | 17 ; 16-qpr2 ; 16 ; … | In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could | HIGH 7.3 | 0.1 % | ||
| CVE-2026-28612 | 17 ; 16-qpr2 ; 16 | In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28611 | 16 ; 15 | In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. | HIGH 7.8 | 0.1 % | ||
| CVE-2026-28609 | 16-qpr2 ; 16 ; 15 ; … | In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution | HIGH 8.8 | 0.4 % | ||
| CVE-2026-28607 | 17 ; 16-qpr2 ; 16 ; … | In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead | HIGH 7.8 | 0.1 % |