chromium-browser: ANGLE: angle: ANGLE: Arbitrary Code Execution via Crafted HTML Page

A flaw was found in ANGLE, a component used in Google Chrome on Android. This buffer overflow vulnerability allows a remote attacker to execute arbitrary code outside of the browser's security sandbox. The exploitation occurs when a user visits a specially crafted HTML page, leading to a severe...

chromium-browser: angle: Google Chrome's ANGLE component: Sandbox escape via out-of-bounds memory access

A flaw was found in Google Chrome's ANGLE component on Android. A remote attacker could exploit an out-of-bounds memory access vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to escape the browser's security sandbox, leading to...

chromium-browser: angle: ANGLE in Google Chrome: Arbitrary code execution via crafted HTML page

A flaw was found in ANGLE, a component of Google Chrome on Android. This 'use after free' vulnerability allows a remote attacker to execute arbitrary code outside the browser's security sandbox. This can be exploited by enticing a user to visit a specially crafted HTML page. Successful exploitati...

CVE-2026-58970: Google Android: In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy

In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58828: Google Android: In multiple functions of base.c, there is a possible use-after-free due to a race condition

In multiple functions of base.c, there is a possible use-after-free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58866: Google Android: In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI…

In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-58875: Google Android: In multiple locations, there is a possible denial of service due to improper input validation

In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58925: Google Android: The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL…

The report details a heap Use-After-Free UAF vulnerability within the android.hardware.automotive.evs-default HAL service, stemming from unsynchronized access to an std::unorderedmap. An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to...

CVE-2026-58989: Google Android: In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission…

In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-59021: Google Android: In multiple locations, there is a possible denial of service due to improper input validation

In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58829: Google Android: In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free

In fusebackingmmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58836: Google Android: In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass…

In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode ECM bypass vulnerability that allows a sideloaded application to modify the package source during a self-update due to a logic error in the code. This could lead to local escalation of privile...

CVE-2026-59044: Google Android: In multiple locations, there is a possible use-after-free due to a logic error in the code

In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-59010: Google Android: In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check

In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-59014: Google Android: In multiple locations, there is a possible out-of-bounds write due to an integer overflow

In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-59012: Google Android: In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a…

In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58971: Google Android: In _mupdf_get_hdr of wprint_mupdf.c, there is a possible out-of-bounds read due to an integer overflow

In mupdfgethdr of wprintmupdf.c, there is a possible out-of-bounds read due to an integer overflow. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55271: Google Android: In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a…

In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55287: Google Android: In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account…

In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

CVE-2026-49935: Google Android: In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path…

In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path traversal. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...