Google

In extract_metadata of dm-android-verity.c, there is a possible way to corrupt kernel memory due to a use after free. Th

Product: AndroidVersions: Android kernelAndroid ID: A-230660904References: N/A

In thermal_cooling_device_stats_update of thermal_sysfs.c, there is a possible out of bounds write due to improper input

In (TBD) of (TBD), there is a possible way to corrupt kernel memory due to a use after free. This could lead to local es

In pppol2tp_create of l2tp_ppp.c, there is a possible use after free due to a race condition. This could lead to local e

In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local es

In _ufdt_output_strtab_to_fdt of ufdt_convert.c, there is a possible out of bounds write due to an incorrect bounds chec

In TBD of ufdt_convert, there is a possible out of bounds read due to memory corruption. This could lead to local escala

In various functions of ap_input_processor.c, there is a possible way to record audio during a phone call due to a logic

In TBD of aud_hal_tunnel.c, there is a possible memory corruption due to a use after free. This could lead to local esca

Product: AndroidVersions: Android kernelAndroid ID: A-212623833References: N/A

In revokeOwnPermissionsOnKill of PermissionManager.java, there is a possible way to determine whether an app is installe

In registerReceivers of DeviceCapabilityListener.java, there is a possible way to change preferred TTY mode due to a per

In MessageQueueBase of MessageQueueBase.h, there is a possible out of bounds read due to a missing bounds check. This co

In launchConfigNewNetworkFragment of NetworkProviderSettings.java, there is a possible way for the guest user to add a n

In ufdt_get_node_by_path_len of ufdt_convert.c, there is a possible out of bounds read due to a missing bounds check. Th

In removeEventHubDevice of InputDevice.cpp, there is a possible OOB read due to a use after free. This could lead to loc

In onCreate of LogAccessDialogActivity.java, there is a possible way to bypass a permission check due to a tapjacking/ov

In btif_a2dp_sink_command_ready of btif_a2dp_sink.cc, there is a possible out of bounds read due to a use after free. Th

In Multiple Locations, there is a possibility to launch arbitrary protected activities due to a confused deputy. This co

In authToken2AidlVec of KeyMintUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. This

In setParameter of EqualizerEffect.cpp, there is a possible out of bounds write due to improper input validation. This c

In multiple functions of AdapterService.java, there is a possible way to manipulate Bluetooth state due to a missing per

In getCurrentConfigImpl of Effect.cpp, there is a possible out of bounds write due to a missing bounds check. This could

In bindArtworkAndColors of MediaControlPanel.java, there is a possible way to crash the phone due to improper input vali

In onOptionsItemSelected of ManageApplications.java, there is a possible bypass of profile owner restrictions due to a m

In multiple locations, there is a possible display crash loop due to improper input validation. This could lead to local

In phNxpNciHal_ioctl of phNxpNciHal.cc, there is a possible out of bounds read due to a missing bounds check. This could

In SurfaceFlinger::doDump of SurfaceFlinger.cpp, there is possible arbitrary code execution due to a use after free. Thi

In parameterToHal of Effect.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead

In getSmsRoleHolder of RoleService.java, there is a possible way to determine whether an app is installed, without query

In createDialog of WifiScanModeActivity.java, there is a possible way for a Guest user to enable location-sensitive sett

In registerBroadcastReceiver of RcsService.java, there is a possible way to change preferred TTY mode due to a missing p

In registerLocalOnlyHotspotSoftApCallback of WifiManager.java, there is a possible way to determine whether an app is in

In getSlice of WifiSlice.java, there is a possible way to connect a new WiFi network from the guest mode due to a missin

In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side cha

In strings.xml, there is a possible permission bypass due to a misleading string. This could lead to remote information

In multiple locations of WifiDialogActivity.java, there is a possible limited lockscreen bypass due to a logic error in

In findParam of HevcUtils.cpp there is a possible out of bounds read due to a missing bounds check. This could lead to l

In HalCoreCallback of halcore.cc, there is a possible out of bounds read due to a missing bounds check. This could lead

In CanvasContext::draw of CanvasContext.cpp, there is a possible out of bounds write due to a missing bounds check. This

In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package nam

In compose of Vibrator.cpp, there is a possible arbitrary code execution due to a use after free. This could lead to loc

In IncFs_GetFilledRangesStartingFrom of incfs.cpp, there is a possible out of bounds read due to a missing bounds check.

In getSlice of ProviderModelSlice.java, there is a missing permission check. This could lead to local escalation of priv

In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing nul

In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of priv

In onCreate of AddAppNetworksActivity.java, there is a possible way for a guest user to configure WiFi networks due to a

In query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead t

In getMessagesByPhoneNumber of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection