EUVD-2026-73972

In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent redirection . This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-28626

CVE-2026-28626 affects Android , specifically the onCreate method in SetupPassthroughActivity.java . The vulnerability stems from Intent redirection , which can be leveraged to launch an arbitrary activity. This leads to a local escalation of privilege requiring no additional execution privileges...

CVE-2026-28624

CVE-2026-28624 is a High severity vulnerability in the Android operating system , as identified in the Android Security Bulletin and patched via Samsung's Security Maintenance Release (SMR) for July 2026 . The root cause is a confused deputy flaw in multiple locations that permits read/write acce...

EUVD-2026-73971

In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73968

In multiple locations, there is a possible unauthorized URI access due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73965

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28616

CVE-2026-28616 affects Android's Setup Wizard , where a confused deputy condition can force the device to connect to a malicious network . This enables local escalation of privilege with no additional execution privileges required and no user interaction needed for exploitation. The vulnerability...

CVE-2026-28614

CVE-2026-28614 is a local elevation of privilege vulnerability in Android's SlicePermissionActivity.java , specifically in its onCreate method. The root cause is a confused deputy that enables a permission bypass , allowing an attacker with no additional execution privileges to escalate their acc...

CVE-2026-28613

CVE-2026-28613 is a local escalation of privilege vulnerability in Android, located in the initAppLinkTypeAndIntent function of ChannelImpl.java . The root cause is improper input validation , which allows the launch of an arbitrary intent . No additional execution privileges are required, but us...

EUVD-2026-73963

In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

EUVD-2026-73962

In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28612

CVE-2026-28612 is a logic error in the resolveActivity method of ActivityStarter.java within the Android framework , enabling Intent Redirection attacks that can lead to local escalation of privilege without additional execution privileges or user interaction. It is classified as High severity in...

CVE-2026-28611

CVE-2026-28611 affects Android's NFC service , specifically multiple functions within NfcService.java . A missing permission check enables silent payment session hijacking , leading to a local escalation of privilege with no additional execution privileges required and no user interaction needed ...

EUVD-2026-73961

In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73959

In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28607

CVE-2026-28607 is a local escalation of privilege vulnerability in Android , caused by a confused deputy that allows a background activity launch bypass across multiple functions and locations. Exploitation requires no additional execution privileges and no user interaction . The vulnerability is...

EUVD-2026-73958

In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28606

A logic error in the handleBondStateChanged method of AdapterService.java (Android Bluetooth stack) allows an attacker to skip the pairing process , leading to remote escalation of privilege without user consent. No additional execution privileges are required, and no user interaction is needed f...

CVE-2026-28603

CVE-2026-28603 is a local escalation of privilege vulnerability in Android's AppRestrictionsFragment.java , specifically in the assertSafeToStartCustomActivity method. The root cause is a confused deputy that permits read/write access to private files. Exploitation requires no additional executio...

EUVD-2026-73956

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...