CVE-2026-28658

CVE-2026-28658 is a local privilege escalation vulnerability in the findMetaAuthUid function of AccountsDb.java within the Android platform, caused by a logic error that allows a file resource protection (FRP) bypass . An attacker with low local privileges can exploit it without user interaction,...

EUVD-2026-73989

In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28656

This vulnerability affects DeviceAdminAdd.java in Android Wear (disclosed in the 2026-09-01 security bulletin). Multiple functions are susceptible to a tapjacking/overlay attack , allowing a local escalation of privilege with only low privileges and user interaction required. The CVSS 3.1 score i...

EUVD-2026-73987

In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-28655

In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73985

In multiple functions of rwt3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28653

CVE-2026-28653 is an integer overflow vulnerability in multiple functions of rw_t3t.cc , an Android media framework component responsible for T3T codec handling. The overflow leads to an out-of-bounds write , enabling local privilege escalation with no additional execution privileges or user inte...

CVE-2026-28653

In multiple functions of rwt3t.cc, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28652

CVE-2026-28652 affects the Ultra-Wideband (UWB) component of Android, specifically multiple functions in RangingServiceImpl.java . The vulnerability is a missing permission check in ranging data parsing that enables a possible man-in-the-middle (MITM) attack, resulting in remote information discl...

EUVD-2026-73984

In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28642

In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28638

CVE-2026-28638 is an information disclosure flaw in XmpDataParser.java within Android's Media Provider component, caused by improper data sanitization due to a logic error. It allows local disclosure of information without additional privileges or user interaction. The vulnerability affects Andro...

EUVD-2026-73978

In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28636

In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28634

In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73976

In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28633

CVE-2026-28633 is a persistent denial of service vulnerability in the initForUserNoTracing method of VoiceInteractionManagerService.java , part of the Android Framework. The root cause is resource exhaustion , which can lead to local denial of service requiring only low privileges and no user int...

CVE-2026-28631

CVE-2026-28631 is a consent bypass vulnerability in Android's IntentForwarderActivity.java (specifically the buildMiniResolver method), exploitable via a tapjacking/overlay attack . The flaw allows local escalation of privilege without additional execution privileges and without user interaction....

EUVD-2026-73974

In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28627

CVE-2026-28627 is a vulnerability in Android's Bluetooth stack , specifically in the btm_sec_encrypt_change function of btm_sec.cc. A logic error enables a downgrade attack , allowing remote information disclosure without additional privileges or user interaction. The CVSS 3.1 score is 4.3 (Mediu...