Browse CVEs

HIGH 7.8 CVE-2025-26440 In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This could lea… Android Patch available Fix from $1,9502025-09-04 HIGH 7.8 CVE-2025-26444 In onHandleForceStop of VoiceInteractionManagerService.java, there is a bug that could cause the system to incorrectly revert to the default assistan… Android Patch available Fix from $1,9502025-09-04 HIGH 7.3 CVE-2025-26443 In parseHtml of HtmlToSpannedParser.java, there is a possible way to install apps without allowing installation from unknown sources due to a logic e… Android Patch available Fix from $1,9502025-09-04 MEDIUM 6.5 CVE-2025-26441 In add_attr of sdp_discovery.cc, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosu… Android Patch available Fix from $1,6002025-09-04 MEDIUM 5.5 CVE-2025-26442 In onCreate of NotificationAccessConfirmationActivity.java, there is a possible incorrect verification of proper intent filters in NLS due to a logic… Android Patch available Fix from $1,6002025-09-04 HIGH 8.8 CVE-2025-26438 In smp_process_secure_connection_oob_data of smp_act.cc, there is a possible way to bypass SMP authentication due to Incorrect implementation of a pr… Android Patch available Fix from $1,9502025-09-04 HIGH 7.8 CVE-2025-26435 In updateState of ContentProtectionTogglePreferenceController.java, there is a possible way for a secondary user to disable the primary user's decept… Android Patch available Fix from $1,9502025-09-04 HIGH 7.8 CVE-2025-26436 In clearAllowBgActivityStarts of PendingIntentRecord.java, there is a possible way for an application to launch an activity from the background due t… Android Patch available Fix from $1,9502025-09-04 MEDIUM 5.5 CVE-2025-26437 In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missing permissi… Android Patch available Fix from $1,6002025-09-04 HIGH 7.8 CVE-2025-26430 In getDestinationForApp of SpaAppBridgeActivity, there is a possible cross-user file reveal due to a logic error in the code. This could lead to loca… Android Patch available Fix from $1,9502025-09-04 MEDIUM 5.5 CVE-2025-26429 In collectOps of AppOpsService.java, there is a possible way to cause permanent DoS due to improper input validation. This could lead to local denial… Android Patch available Fix from $1,6002025-09-04 MEDIUM 5.5 CVE-2025-26432 In multiple locations, there is a possible way to persistently DoS the device due to a missing length check. This could lead to local denial of servi… Android Patch available Fix from $1,6002025-09-04 MEDIUM 6.2 CVE-2025-26423 In validateIpConfiguration of WifiConfigurationUtil.java, there is a possible way to trigger a permanent DoS due to a missing bounds check. This coul… Android Patch available Fix from $1,6002025-09-04 MEDIUM 5.1 CVE-2025-26426 In BroadcastController.java of registerReceiverWithFeatureTraced, there is a possible way to receive broadcasts meant for the "android" package due t… Android Mitigation only Fix from $1,6002025-09-04 MEDIUM 5.1 CVE-2025-0087 In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could le… Android Mitigation only Fix from $1,6002025-09-04 MEDIUM 5.1 CVE-2025-22425 In onCreate of InstallStart.java, there is a possible permissions bypass due to improper input validation. This could lead to local escalation of pri… Android Patch available Fix from $1,6002025-09-04 HIGH 7.8 CVE-2025-36905 In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalatio… Android Mitigation only Fix from $1,9502025-09-04 HIGH 7.8 CVE-2025-36906 In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to lo… Android Mitigation only Fix from $1,9502025-09-04 HIGH 7.3 CVE-2025-36907 In draw_surface_image() of abl/android/lib/draw/draw.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to loc… Android Mitigation only Fix from $1,9502025-09-04 MEDIUM 6.7 CVE-2025-36908 In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local esca… Android Mitigation only Fix from $1,6002025-09-04 MEDIUM 5.3 CVE-2025-36909 Information disclosure Android No fix yet Fix from $1,6002025-09-04 CRITICAL 9.8 CVE-2025-36897 In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code executi… Android Mitigation only Fix from $2,3002025-09-04 CRITICAL 9.8 CVE-2025-36904 WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384. Android Mitigation only Fix from $2,3002025-09-04 HIGH 8.8 CVE-2025-36901 WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223. Android Mitigation only Fix from $1,9502025-09-04 HIGH 8.4 CVE-2025-36899 There is a possible escalation of privilege due to test/debugging code left in a production build. This could lead to physical escalation of privileg… Android Mitigation only Fix from $1,9502025-09-04 HIGH 7.8 CVE-2025-36898 There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional exe… Android Mitigation only Fix from $1,9502025-09-04 HIGH 7.8 CVE-2025-36903 In lwis_io_buffer_write, there is a possible OOB read/write due to improper input validation. This could lead to local escalation of privilege with n… Android Mitigation only Fix from $1,9502025-09-04 MEDIUM 6.7 CVE-2025-36900 In lwis_test_register_io of lwis_device_test.c, there is a possible OOB Write due to an integer overflow. This could lead to local escalation of priv… Android Mitigation only Fix from $1,6002025-09-04 MEDIUM 6.7 CVE-2025-36902 In syna_cdev_ioctl_store_pid() of syna_tcm2_sysfs.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local … Android Mitigation only Fix from $1,6002025-09-04 CRITICAL 9.8 CVE-2025-36890 Elevation of Privilege Android No fix yet Fix from $2,3002025-09-04