Android vulnerabilities and CVEs
Known vulnerabilities affecting Android, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.
144 vulnerabilities tracked. 1 with public exploit code.
- 8.4 In multiple locations, there is a possible use-after-free due to a logic error in the code.
- 8.4 In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.
- 8.4 In multiple locations, there is a possible permission bypass due to a confused deputy.
- 8.4 In multiple locations, there is a possible memory corruption due to a use-after-free.
- 8.4 In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy.
- 8.4 In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy.
- 8.4 In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy.
- 8.4 In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code.
- 8.4 In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a…
- 8.4 In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy.
- 8.4 In dofaultaround of memory.c, there is a possible use after free due to a logic error in the code.
- 8.4 In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code.
- 8.4 In multiple locations, there is a possible permission bypass due to a confused deputy.
- 8.4 In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy.
- 8.4 In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing…
- 8.4 In multiple locations, there is a possible background activity launch due to a logic error in the code.
- 8.4 In fusebackingmmap of backing.c, there is a possible memory corruption due to a use after free.
- 8.4 In multiple functions of base.c, there is a possible use-after-free due to a race condition.
- 8.4 In multiple functions of dma-buf.c, there is a possible use after free due to a race condition.
- 8.4 In ksysunshare of fork.c, there is a possible memory corruption due to a use after free.
- 8.4 In multiple functions of fork.c, there is a possible use after free due to a logic error in the code.
- 8.4 In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy.
- 8.4 In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to…
- 8.4 In multiple locations, there is a possible memory safety issue due to a use-after-free.
- 8.4 In multiple locations, there is a possible use-after-free due to a race condition.
- 8.4 In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy.
- 8.4 In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due…
- 8.4 In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI.
- 8.4 In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy.
- 8.4 In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code.
- 8.4 In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy.
- 8.4 In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code.
- 8.4 In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation.
- 8.4 In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in…
- 7.8 In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that…
- 7.8 In multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds check.
- 7.8 In resolveContentProvider of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code.
- 7.8 In multiple locations, there is a possible way to reveal images across users due to improper input validation.
- 7.5 In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check.
- 7.0 In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created…
- 6.8 In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the…
- 5.5 In multiple files, there is a possible way to reveal information across users due to a missing permission check.
- 3.3 In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass.
- — In isvalidheader of timedcacheitem.c, there is a possible out-of-bounds write due to a missing bounds check.
- — An unprivileged application can exploit a lack of package/signature validation in SystemUI's RemoteQCController when resolving a hardcoded…
- — The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized std::weakptr within…
- — A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a bufferhandlet while the producer thread…
- — The report details a heap Use-After-Free (UAF) vulnerability within the android.hardware.automotive.evs-default HAL service, stemming from…
- — The vulnerability is a heap out-of-bounds read in the EVS HAL's getStreamList() method.
- — A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up…
- — An unprivileged application can bypass the android.car.permission.CARDISPLAYINCLUSTER permission by registering an activity with the…
- — The ClusterRenderingService.dump() method, accessible to processes holding android.permission.DUMP and…
- — In rbcpuinit of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check.
- — In multiple locations, there is a possible denial of service due to a logic error in the code.
- — In pkvmguestrelinquishtohost of memprotect.c, there is a possible out-of-bounds write due to improper input validation.
- — In multiple locations, there is a possible memory corruption due to a race condition.
- — In armlpaesplitblkunmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition.
- — In pkvmpagestoppages of mmu.c, there is a possible out-of-bounds write due to a race condition.
- — In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code.
- — In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code.
Showing the 60 that warrant attention first, of 144. Search the full feed for Android.
What this covers
This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Android is free of vulnerabilities.
Query this from an agent over MCP · Check a lockfile by version
Other products tracked here
Windows 11 version 26H1 Windows 11 Version 25H2 Windows 11 Version 24H2 Windows Server 2025 (Server Core installation) Windows Server 2025 Windows Server 2022 Windows 10 Version 21H2 Windows Server 2019 (Server Core installation) Windows 10 Version 22H2 Windows Server 2019 Windows 10 Version 1809 Windows Server 2016 (Server Core installation) Windows Server 2016 Windows 10 Version 1607 Windows Server 2012 R2 (Server Core installation) Windows Server 2012 R2 Windows Server 2012 (Server Core installation) Windows Server 2012 Red Hat Enterprise Linux 9 MediaTek chipset Red Hat Enterprise Linux 8 n/a Windows 11 Version 26H2 Windows 11 Version 23H2