Google

In captureImage of CustomizedSensor.cpp, there is a possible way to bypass the fingerprint unlock due to a logic error i

In _ufdt_output_property_to_fdt of ufdt_convert.c, there is a possible out of bounds write due to an incorrect bounds ch

In multiple functions of SnoozeHelper.java, there is a possible failure to persist settings due to an uncaught exception

In on_iso_link_quality_read of btm_iso_impl.h, there is a possible out of bounds read due to a missing bounds check. Thi

In btm_ble_process_periodic_adv_sync_lost_evt of ble_scanner_hci_interface.cc , there is a possible out of bounds read d

In btm_ble_rand_enc_complete of btm_ble.cc, there is a possible out of bounds read due to a missing bounds check. This c

In btm_ble_write_adv_enable_complete of btm_ble_gap.cc, there is a possible out of bounds read due to a missing bounds c

In btm_read_rssi_complete of btm_acl.cc, there is a possible out of bounds read due to a missing bounds check. This coul

In btm_read_link_quality_complete of btm_acl.cc, there is a possible out of bounds read due to a missing bounds check. T

In btm_ble_clear_resolving_list_completecomplete of btm_ble_privacy.cc, there is a possible out of bounds read due to a

In BTA_GATTS_HandleValueIndication of bta_gatts_api.cc, there is a possible out of bounds write due to improper input va

In ParseBqrLinkQualityEvt of btif_bqr.cc, there is a possible out of bounds read due to a missing bounds check. This cou

In btm_ble_rand_enc_complete of btm_ble.cc, there is a possible out of bounds read due to a missing bounds check. This c

In btm_read_tx_power_complete of btm_acl.cc, there is a possible out of bounds read due to a missing bounds check. This

In btu_ble_rc_param_req_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. This c

In btu_ble_ll_conn_param_upd_evt of btu_hcif.cc, there is a possible out of bounds read due to a missing bounds check. T

In GetNextSourceDataPacket of bta_av_co.cc, there is a possible out of bounds read due to a missing bounds check. This c

In btm_ble_read_remote_features_complete of btm_ble_gap.cc, there is a possible out of bounds read due to improper input

In getConfirmationMessage of DefaultAutofillPicker.java, there is a possible way to mislead the user to select default a

In getAvailabilityStatus of EnableContentCapturePreferenceController.java, there is a possible way to bypass DISALLOW_CO

In btm_ble_add_resolving_list_entry_complete of btm_ble_privacy.cc, there is a possible out of bounds read due to a miss

In btm_create_conn_cancel_complete of btm_sec.cc, there is a possible out of bounds read due to a missing bounds check.

In btm_vendor_specific_evt of btm_devctl.cc, there is a possible out of bounds read due to a missing bounds check. This

In removePermission of PermissionManagerServiceImpl.java, there is a possible way to obtain dangerous permissions withou

In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could

In multiple locations of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could

In multiple functions of p2p_iface.cpp, there is a possible out of bounds read due to a missing bounds check. This could

In inflate of inflate.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local

In multiple functions of MediaSessionRecord.java, there is a possible Intent rebroadcast due to a confused deputy. This

In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional

In getSliceEndItem of MediaVolumePreferenceController.java, there is a possible way to start foreground activity from th

In launchDeepLinkIntentToRight of SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities

In AddSupervisedUserActivity, guest users are not prevented from starting the activity due to missing permissions checks

In read_paint of ttcolr.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to loca

In onAttach of SettingsPreferenceFragment.java, there is a possible bypass of Factory Reset Protections due to a confuse

In Import of C2SurfaceSyncObj.cpp, there is a possible out of bounds write due to a missing bounds check. This could lea

In onPrepareOptionsMenu of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and unins

In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check. This could l

In onPrimaryClipChanged of ClipboardListener.java, there is a possible way to bypass factory reset protection due to inc

In A2DP_BuildCodecHeaderSbc of a2dp_sbc.cc, there is a possible out of bounds write due to a missing bounds check. This

In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible out of bounds write due to a missing bounds check. Thi

In getGroupState of GrantPermissionsViewModel.kt, there is a possible way to keep a one-time permission granted due to a

In bta_av_rc_disc_done of bta_av_act.cc, there is a possible out of bounds write due to a missing bounds check. This cou

In avdt_scb_hdl_write_req of avdt_scb_act.cc, there is a possible out of bounds write due to a heap buffer overflow. Thi

In sendHalfSheetCancelBroadcast of HalfSheetActivity.java, there is a possible way to learn nearby BT MAC addresses due

In onParentVisible of HeaderPrivacyIconsController.kt, there is a possible way to bypass factory reset protections due t

In onTargetSelected of ResolverActivity.java, there is a possible way to share a wrong file due to a logic error in the

In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due t

In add of WifiNetworkSuggestionsManager.java, there is a possible way to trigger permanent DoS due to resource exhaustio

In onPackageAddedInternal of PermissionManagerService.java, there is a possible way to silently grant a permission after