CVE-2026-59042: Google Android: In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition

In pkvmpagestoppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58936: Google Android: In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free

In pngsettRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58938: Google Android: In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation

In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55262: Google Android: In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy…

In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...

CVE-2026-55275: Google Android: In multiple locations, there is a possible use-after-free due to a race condition

In multiple locations, there is a possible use-after-free due to a race condition. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-55289: Google Android: In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused…

In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49923: Google Android: In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in…

In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-0053: Google Android: In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to…

In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between Android users. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2026-58814: Google Android: In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow

In parseContentType of PduParser.java, there is a possible denial of service due to an integer overflow. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58962: Google Android: In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing…

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-119736: Petpooja Munshi: Attendo (formerly Petpooja Payroll) Admin Android application version 3.0.13 and earlier contains a hard-coded…

Attendo formerly Petpooja Payroll Admin Android application version 3.0.13 and earlier contains a hard-coded credentials vulnerability that allows attackers to extract production MQTT broker credentials by decompiling the APK's bundled Flutter configuration assets such as production.json and...

PT-2026-135710

Name of the Vulnerable Software and Affected Versions Google Android affected versions not specified Description Multiple functions within ipphelper.c contain a stack-based buffer overflow caused by a missing bounds check. This flaw allows a remote attacker to cause a denial of service without...

CVE-2026-59047: Google Android: In multiple locations, there is a possible denial of service due to a logic error in the code

In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58986: Google Android: In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a…

In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26433: Google Android: In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay…

In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-55283: Google Android: In multiple locations, there is a possible memory safety issue due to a use-after-free

In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58873: Google Android XR: In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission…

In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-58969: Google Android: In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission…

In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-59048: Google Android: In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check

In rbcpuinit of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-49912: Google Android: In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due…

In multiple functions of MediaCarouselController.kt, there is a possible way for media to show up after disablement due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...