EUVD-2026-73981

In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28642

CVE-2026-28642 is a High -severity vulnerability in the Android System framework, specifically in executeRequest of ActivityStarter.java. A logic error allows a background activity launch , enabling local escalation of privilege with no additional execution privileges and no user interaction requ...

EUVD-2026-73980

In rwmfchandlereadop of rwmfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28639

CVE-2026-28639 is a critical out-of-bounds write vulnerability in the Android system, located in the function rw_mfc_handle_read_op within rw_mfc.cc. The root cause is a logic error in the code. Exploitation requires no additional execution privileges and no user interaction , enabling a local es...

EUVD-2026-73978

In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28636

CVE-2026-28636 is a confused deputy vulnerability in the setupLayout method of PickActivity.java within Android. It allows a bypass of the "Install unknown apps" security restriction, leading to local escalation of privilege with no additional execution privileges required and no user interaction...

EUVD-2026-73977

In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28634

CVE-2026-28634 is a local escalation of privilege vulnerability in PhoneInterfaceManager.java (handleUssdRequest) within the Android framework. A logic error allows a caller to send a USSD request without the required permission, enabling privilege escalation with no additional execution privileg...

EUVD-2026-73975

In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28631

CVE-2026-28631 is a High -severity vulnerability in Android's IntentForwarderActivity.java , specifically in the buildMiniResolver method. The root cause is a tapjacking/overlay attack that enables a consent bypass , leading to local escalation of privilege without requiring additional execution ...

EUVD-2026-73972

In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-28626

CVE-2026-28626 affects Android , specifically the onCreate method in SetupPassthroughActivity.java . The vulnerability stems from Intent redirection , which can be leveraged to launch an arbitrary activity. This leads to a local escalation of privilege requiring no additional execution privileges...

CVE-2026-28624

CVE-2026-28624 is a High severity vulnerability in the Android operating system , as identified in the Android Security Bulletin and patched via Samsung's Security Maintenance Release (SMR) for July 2026 . The root cause is a confused deputy flaw in multiple locations that permits read/write acce...

EUVD-2026-73971

In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73968

In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73965

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28616

CVE-2026-28616 affects Android's Setup Wizard , where a confused deputy condition can force the device to connect to a malicious network . This enables local escalation of privilege with no additional execution privileges required and no user interaction needed for exploitation. The vulnerability...

CVE-2026-28614

CVE-2026-28614 is a local elevation of privilege vulnerability in Android's SlicePermissionActivity.java , specifically in its onCreate method. The root cause is a confused deputy that enables a permission bypass , allowing an attacker with no additional execution privileges to escalate their acc...

CVE-2026-28613

CVE-2026-28613 is a local escalation of privilege vulnerability in Android, located in the initAppLinkTypeAndIntent function of ChannelImpl.java . The root cause is improper input validation , which allows the launch of an arbitrary intent . No additional execution privileges are required, but us...

EUVD-2026-73963

In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...