Google

In add_attr of sdp_discovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead t

In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permi

In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Inc

In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credenti

In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activ

In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disa

In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could

In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the

In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. Th

In startLockTaskMode of LockTaskController.java, there is a possible lock screen bypass due to a logic error in the code

In multiple locations, there is a possible Android/data access due to a path traversal error. This could lead to local e

In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant fo

In multiple functions of RoleService.java, there is a possible permission squatting vulnerability due to a logic error i

In multiple functions of VpnManager.java, there is a possible cross-user data leak due to a logic error in the code. Thi

In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a mi

In dump of WindowManagerService.java, there is a possible way of running dumpsys without the required permission due to

In multiple locations, there is a possible lock screen bypass due to a logic error in the code. This could lead to local

In multiple functions of GrantPermissionsActivity.java , there is a possible way to trick the user into granting the inc

In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could le

In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing pe

In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This could

In MMapVAccess of pmr_os.c, there is a possible out of bounds write due to improper input validation. This could lead to

In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type confusion. This could lead to

Information disclosure

In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an incorrect bounds check.

In draw_surface_image() of abl/android/lib/draw/draw.c, there is a possible out of bounds write due to a heap buffer ove

In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due to a heap buffer ov

In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This

WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384.

In lwis_io_buffer_write, there is a possible OOB read/write due to improper input validation. This could lead to local e

In syna_cdev_ioctl_store_pid() of syna_tcm2_sysfs.c, there is a possible out of bounds write due to a heap buffer overfl

WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223.

In lwis_test_register_io of lwis_device_test.c, there is a possible OOB Write due to an integer overflow. This could lea

There is a possible escalation of privilege due to test/debugging code left in a production build. This could lead to ph

There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of pri

In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. This coul

WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106.

Information disclosure

In TBD of TBD, there is a possible DoS due to a missing null check. This could lead to remote denial of service with no

In ReadTachyonCommands of gxp_main_actor.cc, there is a possible information leak due to uninitialized data. This could

Denial of service

Elevation of privilege

Elevation of Privilege

In wl_cfgscan_update_v3_schedscan_results() of wl_cfgscan.c, there is a possible out of bounds write due to an incorrec

In wl_update_hidden_ap_ie() of wl_cfgscan.c, there is a possible out of bounds write due to improper input validation. T

In SAEMM_DiscloseMsId of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check

Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker t

Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass c

Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who

Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows