Google

While processing the HTT_T2H_MSG_TYPE_MGMT_TX_COMPL_IND message, a buffer overflow can potentially occur in Android rele

In wlan_hdd_cfg80211_set_privacy_ibss() in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS

In the ADSP RPC driver in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD And

While processing fragments, when the fragment count becomes very large, an integer overflow leading to a buffer overflow

A buffer over-read can occur during a fast initial link setup (FILS) connection in Android releases from CAF using the l

In the FastRPC driver in Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Andr

In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security p

Possible buffer overflows and array out of bounds accesses in Android releases from CAF using the linux kernel (Android

Due to a race condition while processing the power stats debug file to read status, a double free condition can occur in

In Android releases from CAF using the linux kernel (Android for MSM, Firefox OS for MSM, QRD Android) before security p

While flashing meta image, a buffer over-read may potentially occur when the image size is smaller than the image header

While flashing a meta image, a buffer over-read can potentially occur when the number of images are out of the maximum r

The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from r

If userspace provides a too-large WPA RSN IE length in wlan_hdd_cfg80211_set_ie(), a buffer overflow occurs in all Andro

In the MDSS driver in all Android releases(Android for MSM, Firefox OS for MSM, QRD Android) from CAF using the Linux ke

User process can perform the kernel DOS in ashmem when doing cache maintenance operation in all Android releases(Android

In the WCD CPE codec, a Use After Free condition can occur in all Android releases(Android for MSM, Firefox OS for MSM,

A stack-based buffer overflow can occur in fastboot from all Android releases(Android for MSM, Firefox OS for MSM, QRD A

BoringSSL through 2018-06-14 allows a memory-cache side-channel attack on DSA signatures, aka the Return Of the Hidden N

An issue was discovered in Google Santa and molcodesignchecker. A maliciously crafted Universal/fat binary can evade thi

Buffer over flow can occur while processing a HTT_T2H_MSG_TYPE_TX_COMPL_IND message with an out-of-range num_msdus value

Due to a race condition in the QTEECOM driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD

In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result

Early or late retirement of rotation requests can result in a Use After Free condition in all Android releases from CAF

In the video driver function set_output_buffers(), binfo can be accessed after being freed in a failure scenario in all

In the function wma_pdev_div_info_evt_handler() in all Android releases from CAF (Android for MSM, Firefox OS for MSM, Q

An arbitrary address write can occur if a compromised WLAN firmware sends incorrect data to WLAN driver in all Android r

Buffer overflow can occur due to improper input validation in multiple WMA event handler functions in all Android releas

In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux K

In the WLAN driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux K

improper validation of array index in WiFi driver function sapInterferenceRssiCount() leads to array out-of-bounds acces

While processing a DSP buffer in an audio driver's event handler, an index of a buffer is not checked before accessing t

In the KGSL driver in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux K

In wma_ndp_end_response_event_handler(), the variable len_end_rsp is a uint32 which can be overflowed if the value of va

In the camera driver, an out-of-bounds access can occur due to an error in copying region params from user space in all

The value of fix_param->num_chans is received from firmware and if it is too large, an integer overflow can occur in wma

Due to a race condition in a bus driver, a double free in msm_bus_floor_vote_context() can potentially occur in all Andr

Buffer might get used after it gets freed due to unlocking the mutex before freeing the buffer in all Android releases f

A spoofing vulnerability can occur when a malicious site with an extremely long domain name is opened in an Android Cust

A spoofing vulnerability can occur when a page switches to fullscreen mode without user notification, allowing a fake ad

A mechanism where when a new tab is loaded through JavaScript events, if fullscreen mode is then entered, the addressbar

Android intent URLs given to Firefox for Android can be used to navigate from HTTP or HTTPS URLs to local "file:" URLs,

Android intents can be used to launch Firefox for Android in reader mode with a user specified URL. This allows an attac

Malicious sites can display a spoofed location bar on a subsequently loaded page when the existing location bar on the n

A location bar spoofing attack where the location bar of loaded page will be shown over the content of another tab due t

Weak proxy objects have weak references on multiple threads when they should only have them on one, resulting in incorre

The location bar in Firefox for Android can be spoofed by forcing a user into fullscreen mode, blocking its exiting, and

Private browsing mode leaves metadata information, such as URLs, for sites visited in "browser.db" and "browser.db-wal"

A previously installed malicious Android application which defines a specific signature-level permissions used by Firefo

A previously installed malicious Android application with same signature-level permissions as Firefox can intercept Auth