Google Android elevation of privilege vulnerability (CNVD-2025-12378)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability due to a competitive condition flaw in multiple functions in AccountManagerService.java, which can be exploited by an attacker to gain elevated privileges ...

Google Android Code Execution Vulnerability (CNVD-2025-10930)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from a code execution vulnerability that is caused due to a flaw in a system component. An attacker can exploit the vulnerability to execute arbitrary code on the system...

Google Android elevation of privilege vulnerability (CNVD-2025-11431)

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates in the WindowOrganizerController.java file's applyTaskFragmentOperation function, which contains a logic error that can be exploited by an...

CVE-2025-3067

Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted app. Chromium security severity: Medium...

CVE-2025-3068

Inappropriate implementation in Intents in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-3067

Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted app. Chromium security severity: Medium...

CVE-2025-3067

CVE-2025-3067 affects Google Chrome/Chromium on Android via an Inappropriate implementation in Custom Tabs, prior to version 135.0.7049.52. Root cause: flawed handling of UI gestures enabling privilege escalation via a crafted app. Impact per CVE: high confidentiality, integrity, and availability...

CVE-2024-0245 Task Hijacking in hamza417/inure

A misconfiguration in the AndroidManifest.xml file in hamza417/inure before build97 allows for task hijacking. This vulnerability permits malicious applications to inherit permissions of the vulnerable app, potentially leading to the exposure of sensitive information. An attacker can create a...

CVE-2025-25758

An issue in KukuFM Android v1.12.7 11207 allows attackers to access sensitive cleartext data via the android:allowBackup="true" in the ANdroidManifest.xml...

CVE-2025-2356

A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...

CVE-2025-2356

A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...

CVE-2025-2355

A vulnerability was found in BlackVue App 3.65 on Android and classified as problematic. Affected by this issue is some unknown functionality of the component API Endpoint Handler. The manipulation of the argument BCSTOKEN/SECRETKEY leads to unprotected storage of credentials. Local access is...

CVE-2025-2356

CVE-2025-2356 affects BlackVue App 3.65 on Android. The vulnerability lies in the API Handler’s deviceDelete function, where a GET request with sensitive query strings can be exploited remotely. Exploitability is described as high complexity with remote initiation, and the exploit has been public...

CVE-2025-2356 BlackVue App API deviceDelete get request method with sensitive query strings

A vulnerability was found in BlackVue App 3.65 on Android. It has been classified as problematic. This affects the function deviceDelete of the component API Handler. The manipulation leads to use of get request method with sensitive query strings. It is possible to initiate the attack remotely...

CVE-2025-2355 BlackVue App API Endpoint credentials storage

A vulnerability was found in BlackVue App 3.65 on Android and classified as problematic. Affected by this issue is some unknown functionality of the component API Endpoint Handler. The manipulation of the argument BCSTOKEN/SECRETKEY leads to unprotected storage of credentials. Local access is...

CVE-2025-27606

CVE-2025-27606 – Element Android PIN autologout bypass . Element Android (Android Matrix Client) up to version 1.6.32 can fail to log out after a user-entered PIN is wrong beyond the configured limit, enabling a local attacker with physical access to guess the PIN. The issue is fixed in version 1...

PT-2025-11055 · Google · Android

Name of the Vulnerable Software and Affected Versions: sdp discovery affected versions not specified Description: A use after free issue exists in the process service attr rsp function of sdp discovery.cc. This could lead to remote code execution without requiring additional privileges or user...

PT-2025-11061 · Google · Android

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. affected versions not specified Description: A flaw exists that may allow access to content across user profiles due to URI double encoding. This could result in local information disclosure without...

PT-2025-11063 · Google · Android

Name of the Vulnerable Software and Affected Versions: AccountManagerService affected versions not specified Description: A flaw exists in the onResult function of AccountManagerService.java due to a missing permission check. This could allow overwriting of an authentication token, potentially...

PT-2025-11067 · Google · Android

Name of the Vulnerable Software and Affected Versions: avct lcb act.cc affected versions not specified Description: A use-after-free issue exists in the avct lcb msg ind function within avct lcb act.cc. Successful exploitation of this issue could lead to local escalation of privilege without...