CVE-2026-49935: Google Android: In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path…

In getXmlFileNameForUser of LocaleManagerService.java, there is a possible permission bypass due to a confusable path traversal. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49906: Google Android: An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an…

An unprivileged application can bypass the android.car.permission.CARDISPLAYINCLUSTER permission by registering an activity with the android.car.cluster.NAVIGATION category and requesting navigation app focus. The privileged ClusterHomeSample application, acting as a confused deputy, resolves and...

CVE-2026-49922: Google Android: In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a…

In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55257: Google Android: In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI

In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55261: Google Android: In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing…

In nfat4tnfceestorerxbuf of nfanfceeact.cc, there is a possible way to achieve code execution due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58964: Google Android: In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation

In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58975: Google Android: In multiple locations, there is a possible out-of-bounds write due to a missing bounds check

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58821: Google Android: In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL…

In multiple functions of SearchRequestDatabaseUtil.java, there is a possible way to access protected data due to SQL injection. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58924: Google Android: The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method

The vulnerability is a heap out-of-bounds read in the EVS HAL's getStreamList method. An attacker can craft a CameraDesc.metadata byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is then...

CVE-2026-58877: Google Android: In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused…

In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58944: Google Android: In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal)…

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch bal issue due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58953: Google Android: In dec_vlc_read of oapv_vlc.c, there is a possible out-of-bounds read due to a heap buffer overflow

In decvlcread of oapvvlc.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58876: Google Android: In multiple locations, there is a possible memory safety issue due to a use-after-free

In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28621: Google Android: In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check

In getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28588: Google Android: In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due…

In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28645: Google Android: In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a…

In onStrongAuthRequiredChanged of UsbService.java, there is a possible unauthenticated enabling of USB data due to a logic error in the code. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28632: Google Android: In multiple locations, there is a possible way to share files across profiles due to a logic error in the code

In multiple locations, there is a possible way to share files across profiles due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49931: Google Android: In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused…

In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49903: Google Android: The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and…

The ClusterRenderingService.dump method, accessible to processes holding android.permission.DUMP and android.permission.PACKAGEUSAGESTATS, acts as a confused deputy. It allows attackers to write arbitrary values to Settings.Global.OVERLAYDISPLAYDEVICES, an operation normally requiring...

PT-2026-135646

Attendo formerly Petpooja Payroll Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and...