CVE Intelligence

Google Android vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Google Android: 627 record(s), with affected versions and fixes.
cpe:2.3:o:google:android

CVE-2025-20721 High · 7.8 CWE-787 Oct 14, 2025
Out-of-bounds Write in Mediatek Iot Yocto
In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10089545; Issue ID: MSV-4279.
CVE-2025-48543 High · 8.8 KEV High · 54 Public exploit CWE-416 Sep 4, 2025
Android Runtime Use-After-Free Vulnerability
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-50302 Medium · 5.5 KEV High · 46 CWE-908 Nov 18, 2024
Linux Kernel Use of Uninitialized Resource Vulnerability
In the Linux kernel, the following vulnerability has been resolved: HID: core: zero-initialize the report buffer Since the report buffer is used by all kinds of drivers in various ways, let's zero-initialize it during allocation to make sure that it can't be ever used to leak kernel memory via specially-crafted report.
CVE-2024-43093 High · 7.3 KEV High · 49 CWE-176 Nov 13, 2024
Android Framework Privilege Escalation Vulnerability
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2024-32896 High · 7.8 KEV High · 54 CWE-670 Jun 13, 2024
Android Pixel Privilege Escalation Vulnerability
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2024-29745 Medium · 5.5 KEV CWE-908 Apr 5, 2024
Android Pixel Information Disclosure Vulnerability
there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2024-29748 High · 7.8 KEV High · 49 CWE-755 Apr 5, 2024
Android Pixel Privilege Escalation Vulnerability
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
CVE-2023-35674 High · 7.8 KEV High · 60 Public exploit CWE-269 Sep 11, 2023
Android Framework Privilege Escalation Vulnerability
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2023-21237 Medium · 5.5 KEV CWE-200 Jun 28, 2023
Android Pixel Information Disclosure Vulnerability
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-251586912
CVE-2023-20963 High · 7.8 KEV High · 58 Public exploit CWE-295 Mar 24, 2023
Android Framework Privilege Escalation Vulnerability
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519
CVE-2022-20572 Medium · 6.7 CWE-862 Dec 16, 2022
In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to...
In verity_target of dm-verity-target.c, there is a possible way to modify read-only files due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-234475629References: Upstream kernel
CVE-2022-20566 High · 7.8 CWE-416 Dec 16, 2022
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This...
In l2cap_chan_put of l2cap_core, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-165329981References: Upstream kernel
CVE-2022-20422 High · 7.0 CWE-667 Oct 11, 2022
In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to...
In emulation_proc_handler of armv8_deprecated.c, there is a possible way to corrupt memory due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-237540956References: Upstream kernel
CVE-2022-20421 High · 7.8 CWE-416 Oct 11, 2022
In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use...
In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239630375References: Upstream kernel
CVE-2022-20154 Medium · 6.4 CWE-362 Jun 15, 2022
In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This...
In lock_sock_nested of sock.c, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-174846563References: Upstream kernel
CVE-2022-20153 Medium · 6.7 CWE-667 Jun 15, 2022
In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to…
In rcu_cblist_dequeue of rcu_segcblist.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-222091980References: Upstream kernel
CVE-2021-39793 High · 7.8 KEV High · 49 CWE-787 Mar 16, 2022
Google Pixel Out-of-Bounds Write Vulnerability
In kbase_jd_user_buf_pin_pages of mali_kbase_mem.c, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210470189References: N/A
CVE-2022-22265 High · 7.8 KEV High · 46 CWE-703 Jan 10, 2022
Samsung Mobile Devices Use-After-Free Vulnerability
An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.
CVE-2021-1048 High · 7.8 KEV High · 51 CWE-416 Dec 15, 2021
Android Kernel Use-After-Free Vulnerability
In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-204573007References: Upstream kernel
CVE-2021-0920 Medium · 6.4 KEV High · 47 CWE-362 Dec 15, 2021
Android Kernel Race Condition Vulnerability
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-196926917References: Upstream kernel
CVE-2020-0069 High · 7.8 KEV High · 58 Public exploit CWE-787 Mar 10, 2020
Mediatek Multiple Chipsets Insufficient Input Validation Vulnerability
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-147882143References: M-ALPS04356754
CVE-2020-0041 High · 7.8 KEV High · 60 Public exploit CWE-20 Mar 10, 2020
Android Kernel Out-of-Bounds Write Vulnerability
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-145988638References: Upstream kernel
CVE-2019-2215 High · 7.8 KEV Urgent · 76 Public exploit CWE-416 Oct 11, 2019
Android Kernel Use-After-Free Vulnerability
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploitation does require either the installation of a malicious local application or a separate vulnerability in a network facing application.Product: AndroidAndroid ID: A-141720095
CVE-2017-7376 Critical · 9.8 CWE-119 Feb 19, 2018
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an...
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
CVE-2017-7375 Critical · 9.8 CWE-611 Feb 19, 2018
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the...
A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validation, external DTD subset loading, or default DTD attributes). Depending on the context, this may expose a higher-risk attack surface in libxml2 not usually reachable with default parser flags, and expose content from local files, HTTP, or FTP servers (which might be otherwise unreachable).