Total
8912 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2023-20924 | 1 Google | 1 Android | 2025-04-02 | N/A | 6.8 MEDIUM |
|
In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. This could lead to local escalation of privilege with physical access to the device with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-240428519References: N/A
|
|||||
| CVE-2023-20923 | 1 Google | 1 Android | 2025-04-02 | N/A | 5.5 MEDIUM |
|
In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-246933910References: N/A
|
|||||
| CVE-2023-20922 | 1 Google | 1 Android | 2025-04-02 | N/A | 5.5 MEDIUM |
|
In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-237291548
|
|||||
| CVE-2023-20921 | 1 Google | 1 Android | 2025-04-02 | N/A | 7.3 HIGH |
|
In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-243378132
|
|||||
| CVE-2023-20920 | 1 Google | 1 Android | 2025-04-02 | N/A | 7.8 HIGH |
|
In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-204584366
|
|||||
| CVE-2023-20919 | 1 Google | 1 Android | 2025-04-02 | N/A | 7.8 HIGH |
|
In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-252663068
|
|||||
| CVE-2023-20916 | 1 Google | 1 Android | 2025-04-02 | N/A | 7.8 HIGH |
|
In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-229256049
|
|||||
| CVE-2023-20915 | 1 Google | 1 Android | 2025-04-02 | N/A | 7.8 HIGH |
|
In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246930197
|
|||||
| CVE-2023-20913 | 1 Google | 1 Android | 2025-04-02 | N/A | 7.8 HIGH |
|
In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phone account due to a tapjacking/overlay attack. This could lead to local escalation of privilege with User execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-246933785
|
|||||
| CVE-2023-20912 | 1 Google | 1 Android | 2025-04-02 | N/A | 7.8 HIGH |
|
In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-246301995
|
|||||
| CVE-2022-20458 | 1 Google | 1 Android | 2025-04-02 | N/A | 5.5 MEDIUM |
|
The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() could contain sensitive information. However, CarNotificationListener.java, it prints out the StatusBarNotification.getKey() directly in logs, which could contain user's account name (i.e. PII), in Android "user" build.Product: AndroidVersions: Android-12LAndroid ID: A-205567776
|
|||||
| CVE-2022-20456 | 1 Google | 1 Android | 2025-04-02 | N/A | 7.8 HIGH |
|
In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703780
|
|||||
| CVE-2022-20235 | 1 Google | 1 Android | 2025-04-02 | N/A | 5.5 MEDIUM |
|
The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. This page can only be written by the GPU driver itself, but prior to DDK 1.18 however, a user-space program could write arbitrary data to the page, leading to memory corruption issues.Product: AndroidVersions: Android SoCAndroid ID: A-259967780
|
|||||
| CVE-2022-20215 | 1 Google | 1 Android | 2025-04-02 | N/A | 5.5 MEDIUM |
|
In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to local denial of service with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183794206
|
|||||
| CVE-2025-1917 | 1 Google | 2 Android, Chrome | 2025-04-01 | N/A | 4.3 MEDIUM |
|
Inappropriate implementation in Browser UI in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
|
|||||
| CVE-2025-1922 | 1 Google | 2 Android, Chrome | 2025-04-01 | N/A | 4.3 MEDIUM |
|
Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
|
|||||
| CVE-2022-20490 | 1 Google | 1 Android | 2025-04-01 | N/A | 7.8 HIGH |
|
In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-242703505
|
|||||
| CVE-2022-20214 | 1 Google | 1 Android | 2025-04-01 | N/A | 4.7 MEDIUM |
|
In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to modify system settings without user consent.Product: AndroidVersions: Android-10 Android-11 Android-12Android ID: A-183411210
|
|||||
| CVE-2024-20064 | 2 Google, Mediatek | 30 Android, Mt6580, Mt6761 and 27 more | 2025-03-29 | N/A | 7.8 HIGH |
|
In wlan service, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08572601; Issue ID: MSV-1229.
|
|||||
| CVE-2024-0043 | 1 Google | 1 Android | 2025-03-29 | N/A | 7.8 HIGH |
|
In multiple locations, there is a possible notification listener grant to an app running in the work profile due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
|
|||||
| CVE-2023-40111 | 1 Google | 1 Android | 2025-03-29 | N/A | 7.8 HIGH |
|
In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
|
|||||
| CVE-2024-20020 | 2 Google, Mediatek | 8 Android, Mt2713, Mt2715 and 5 more | 2025-03-28 | N/A | 4.4 MEDIUM |
|
In OPTEE, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS08522504; Issue ID: ALPS08522504.
|
|||||
| CVE-2024-0014 | 1 Google | 1 Android | 2025-03-28 | N/A | 7.8 HIGH |
|
In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
|
|||||
| CVE-2023-52352 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2025-03-28 | N/A | 5.5 MEDIUM |
|
In Network Adapter Service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges needed
|
|||||
| CVE-2023-52349 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2025-03-28 | N/A | 4.4 MEDIUM |
|
In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
|
|||||
| CVE-2024-0041 | 1 Google | 1 Android | 2025-03-28 | N/A | 7.0 HIGH |
|
In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not needed for exploitation.
|
|||||
| CVE-2024-0022 | 1 Google | 1 Android | 2025-03-27 | N/A | 5.5 MEDIUM |
|
In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
|
|||||
| CVE-2023-52350 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2025-03-27 | N/A | 4.4 MEDIUM |
|
In ril service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
|
|||||
| CVE-2024-32894 | 1 Google | 1 Android | 2025-03-27 | N/A | 7.5 HIGH |
|
In bc_get_converted_received_bearer of bc_utilities.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
|
|||||
| CVE-2024-27229 | 1 Google | 1 Android | 2025-03-27 | N/A | 7.5 HIGH |
|
In ss_SendCallBarringPwdRequiredIndMsg of ss_CallBarring.c, there is a possible null pointer deref due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
|
|||||
| CVE-2024-29778 | 1 Google | 1 Android | 2025-03-27 | N/A | 4.7 MEDIUM |
|
In ProtocolPsDedicatedBearInfoAdapter::processQosSession of protocolpsadapter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with baseband firmware compromise required. User interaction is not needed for exploitation.
|
|||||
| CVE-2024-31310 | 1 Google | 1 Android | 2025-03-27 | N/A | 7.8 HIGH |
|
In newServiceInfoLocked of AutofillManagerServiceImpl.java, there is a possible way to hide an enabled Autofill service app in the Autofill service settings due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
|
|||||
| CVE-2024-0053 | 1 Google | 1 Android | 2025-03-27 | N/A | 3.3 LOW |
|
In getCustomPrinterIcon of PrintManagerService.java, there is a possible way to view other user's images due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
|
|||||
| CVE-2024-0047 | 1 Google | 1 Android | 2025-03-27 | N/A | 5.5 MEDIUM |
|
In writeUserLP of UserManagerService.java, device policies are serialized with an incorrect tag due to a logic error in the code. This could lead to local denial of service when policies are deserialized on reboot with no additional execution privileges needed. User interaction is not needed for exploitation.
|
|||||
| CVE-2024-8034 | 1 Google | 2 Android, Chrome | 2025-03-27 | N/A | 4.3 MEDIUM |
|
Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 128.0.6613.84 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
|
|||||
| CVE-2024-32902 | 1 Google | 1 Android | 2025-03-27 | N/A | 7.5 HIGH |
|
Remote prevention of access to cellular service with no user interaction (for example, crashing the cellular radio service with a malformed packet)
|
|||||
| CVE-2024-34738 | 1 Google | 1 Android | 2025-03-26 | N/A | 7.8 HIGH |
|
In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRead app-op states due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
|
|||||
| CVE-2024-22011 | 1 Google | 1 Android | 2025-03-26 | N/A | 7.5 HIGH |
|
In ss_ProcessRejectComponent of ss_MmConManagement.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
|
|||||
| CVE-2023-52536 | 2 Google, Unisoc | 14 Android, S8000, Sc7731e and 11 more | 2025-03-26 | N/A | 4.4 MEDIUM |
|
In faceid service, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
|
|||||
| CVE-2024-23710 | 1 Google | 1 Android | 2025-03-26 | N/A | 7.8 HIGH |
|
In assertPackageWithSharedUserIdIsPrivileged of InstallPackageHelper.java, there is a possible execution of arbitrary app code as a privileged app due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
|
|||||