Google

In rw_t3t_act_handle_check_ndef_rsp of rw_t3t.cc, there is a possible out of bounds read due to an integer overflow. Thi

In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the S

In acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator of Idmap2Service.c

In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to a missing bounds check. This could lea

In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improp

In getNearbyAppStreamingPolicy of DevicePolicyManagerService.java, there is a missing permission check. This could lead

In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the n

In mapGrantorDescr of MessageQueueBase.h, there is a possible out of bounds write due to a missing bounds check. This co

In onAttach of ConfigureWifiSettings.java, there is a possible way for a guest user to change WiFi settings due to a per

In onMulticastListUpdateNotificationReceived of UwbEventManager.java, there is a possible arbitrary code execution due t

In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of priv

In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could lea

In multiple locations of DreamManagerService.java, there is a missing permission check. This could lead to local escalat

In onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration du

In multiple locations of NfcService.java, there is a possible disclosure of NFC tags due to a confused deputy. This coul

Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit hea

Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the u

Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user

Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit hea

Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit

In deletePackageVersionedInternal of DeletePackageHelper.java, there is a possible way to bypass carrier restrictions du

In GetResolvedMethod of entrypoint_utils-inl.h, there is a possible use after free due to a stale cache. This could lead

In onCreate of EnableAccountPreferenceActivity.java, there is a possible way to mislead the user into enabling a malicio

In loadFromXml of ShortcutPackage.java, there is a possible crash on boot due to an uncaught exception. This could lead

In fdt_path_offset_namelen of fdt_ro.c, there is a possible out of bounds read due to an incorrect bounds check. This co

In updatePublicMode of NotificationLockscreenUserManagerImpl.java, there is a possible way to reveal sensitive notificat

In setDataSource of initMediaExtractor.cpp, there is a possibility of arbitrary code execution due to a use after free.

In getEnabledAccessibilityServiceList of AccessibilityManager.java, there is a possible way to hide an accessibility ser

In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to r

In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to r

In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to r

In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to r

In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to r

In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to r

In several functions that parse avrc response in avrc_pars_ct.cc and related files, there are possible out of bounds rea

In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and requir

In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to r

In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to r

In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to r

In shouldHideNotification of KeyguardNotificationVisibilityProvider.kt, there is a possible way to show hidden notificat

In setEnabledSetting of PackageManager.java, there is a possible way to get the device into an infinite reboot loop due

In test of ResetTargetTaskHelper.java, there is a possible hijacking of any app which sets allowTaskReparenting="true" d

In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a con

In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This c

In toLanguageTag of LocaleListCache.cpp, there is a possible out of bounds read due to an incorrect bounds check. This c

In SendIncDecRestoreCmdPart2 of NxpMfcReader.cc, there is a possible out of bounds read due to a missing bounds check. T

In bindRemoteViewsService of AppWidgetServiceImpl.java, there is a possible way to bypass background activity launch due

In avct_lcb_msg_asmbl of avct_lcb_act.cc, there is a possible out of bounds write due to a missing bounds check. This co

In BNEP_ConnectResp of bnep_api.cc, there is a possible out of bounds read due to an incorrect bounds check. This could

In applyKeyguardFlags of NotificationShadeWindowControllerImpl.java, there is a possible way to observe the user's passw