CVE-2022-20465

CVE-2022-20465 affects Android 10–13 where a logic error in KeyguardHostViewController.java (and related files) can cause a lockscreen bypass via the dismiss() flow, enabling local privilege escalation without user interaction. Connected sources confirm the vulnerable component and impact; mitiga...

CVE-2022-20454

In fdtnexttag of fdt.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12...

CVE-2022-3310

Insufficient policy enforcement in custom tabs in Google Chrome on Android prior to 106.0.5249.62 allowed an attacker who convinced the user to install an application to bypass same origin policy via a crafted application. Chromium security severity: Medium...

Juiker 信任管理问题漏洞

Juiker is an instant messaging software for government and business organizations from Juiker. Juiker suffers from a security vulnerability that stems from the application's use of hard-coded AES keys in the source code. A physical attacker with root access to Android could use the AES key to...

OESA-2022-2006 libexif security update

Most digital cameras produce EXIF files, which are JPEG files with extra tags that contain information about the image. The EXIF library allows you to parse an EXIF file and read the data from those tags. Security Fixes: In libexif, there is a possible out of bounds write due to an integer...

CVE-2022-20420

In getBackgroundRestrictionExemptionReason of AppRestrictionController.java, there is a possible way to bypass device policy restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

Android Automotive OS Update Bulletin—October 2022Stay organized with collectionsSave and categorize content based on your preferences.

The Android Automotive OS AAOS Update Bulletin contains details of security vulnerabilities affecting the Android Automotive OS platform. The full AAOS update comprises the security patch level of 2022-10-05 or later from the October 2022 Android Security Bulletin in addition to all issues in thi...

CVE-2022-39246 matrix-android-sdk2 vulnerable to impersonation via forwarded Megolm sessions

matrix-android-sdk2 is the Matrix SDK for Android. Prior to version 1.5.1, an attacker cooperating with a malicious homeserver can construct messages appearing to have come from another person. Such messages will be marked with a grey shield on some platforms, but this may be missing in others...

CVE-2022-20392

In declareDuplicatePermission of ParsedPermissionUtils.java, there is a possible way to obtain a dangerous permission without user consent due to improper input validation. This could lead to local escalation of privilege during app installation or upgrade with no additional execution privileges...

Android Security Bulletin—September 2022Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2022-09-05 or later address all of these issues. To learn how to check a device's security patch level, see Check and update your Android version. Android partners are...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. A security vulnerability exists in Google Android. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the vendor's announcement...

Cybercriminals Developing BugDrop Malware to Bypass Android Security Features

In a sign that malicious actors continue to find ways to work around Google Play Store security protections, researchers have spotted a previously undocumented Android dropper trojan that's currently in development. "This new malware tries to abuse devices using a novel technique, not seen before...

CVE-2022-20342

In WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure default value. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID...

Out-of-bounds

In Bluetooth, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-209062898...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in the Google Android Content component that stems from a privilege bypass with a possible way to learn the name of a gmail account on a device...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google Inc. in the United States. A security vulnerability exists in the Google Android bluetooth component, which stems from a lack of privilege checking, with a possible method to enable or disable bluetooth connectivity without...

Google Android安全漏洞

Google Android is a Linux-based open source operating system from the American company Google. A security vulnerability exists in Google Android 13. An attacker exploited the vulnerability to escalate local privileges and enable working profiles...

CVE-2022-20312

In Android 13, the WifiP2pManager can leak the device’s WiFi P2P MAC address without user consent due to a missing permission check. This enables local information disclosure with a Local attack vector and no user interaction required. Affected component: WifiP2pManager in Android 13. Root cause:...

CVE-2022-20306

CVE-2022-20306 affects Android 13 via the Camera Provider HAL. The issue is a memory corruption due to a use-after-free in the Camera Provider HAL, enabling local elevation of privileges with SYSTEM rights and no user interaction required. The vulnerability impact is described as local EoP with h...

CVE-2022-20298

CVE-2022-20298 affects Android 13 ContentService. The issue stems from a missing permission check in ContentService, enabling an attacker to determine whether an account exists on the device and potentially disclose local information. Exploitation is local and does not require user interaction, w...