CVE-2018-9581

CVE-2018-9581 describes an information-disclosure flaw in Android where WiFi RSSI (and SSID) data are broadcast via intents (android.net.wifi.RSSI_CHANGE and android.net.wifi.STATE_CHANGE). This cross-process leakage can allow any on-device app to observe a user’s proximity/location context witho...

CVE-2019-9379

CVE-2019-9379 affects the Android 10 libstagefright component. The issue is a resource-exhaustion DoS caused by a missing bounds check in a multimedia processing path. The impact is remote denial of service with no privileges required, and exploitation requires user interaction. There is no docum...

CVE-2019-9361

The CVE-2019-9361 entry concerns Android 10’s libavc (media framework) with an information-disclosure flaw caused by uninitialized data. Affected component: libavc in Android 10 (Android-10). Impact: potential remote information disclosure without executing code; exploitation requires user intera...

CVE-2019-9268

CVE-2019-9268 affects Android’s media stack (libstagefright) with a use-after-free caused by improper locking, enabling local escalation of privilege in the media server without extra privileges. The issue is tied to Android 10 (Android-10) and is documented in the Android 10 Security Release Not...

Google Android USB Driver Elevation of Privilege Vulnerability

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA.USB driver is one of the Universal Serial Bus USB drivers. A privilege elevation vulnerability exists in the USB driver in Android. An attacker can exploit this vulnerability to elevate privileges...

Google Android Touch driver boost vulnerability (CNVD-2019-30703)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA, and Touch driver is one of the touch drivers. An elevation of privilege vulnerability exists in the Touch driver in Android. An attacker can exploit this vulnerability to elevate privileges...

Type confusion

In isPreferred of HidProfile.java in Android 7.1.1, 7.1.2, 8.0, 8.1 and 9, there is a possible device type confusion due to a permissions bypass. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2019-2108

In ihevcdreflist of ihevcdreflist.c in Android 10, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation...

Why 'Zero Day' Android Hacking Now Costs More Than iOS Attacks

Brokers of so-called zero day exploits are paying out more for Android than iOS—which would have been unthinkable until recently...

WARNING — Malware Found in CamScanner Android App With 100+ Million Users

Beware! Attackers can remotely hijack your Android device and steal data stored on it, if you are using free version of CamScanner , a highly-popular Phone PDF creator app with more than 100 million downloads on Google Play Store. So, to be safe, just uninstall the CamScanner app from your Androi...

Google Android Media Framework Input Validation Error Vulnerability (CNVD-2019-40854)

Android is a Linux-based open source operating system from Google and the Open Handset Alliance OHA in the U.S. Media Framework is one of the multimedia development frameworks. A security vulnerability exists in Media framework in Android. An attacker can exploit this vulnerability to cause a...

Android Users Can Now Log in to Google Services Using Fingerprint

If you're using Chrome on Android, you can now sign-in to your Google account and some of the other Google services by simply using your fingerprint, instead of typing in your password every time. Google is rolling out a new feature, called "local user verification," that allows you to log in to...

Android July 2019 Security Update Patches 33 New Vulnerabilities

Google has started rolling out this month's security updates for its mobile operating system platform to address a total of 33 new security vulnerabilities affecting Android devices, 9 of which have been rated critical in severity. The vulnerabilities affect various Android components, including...

AndroidSecNotes

It is an offensive tool for Android. The repository contains learning notes about Android Security, specifically about the Android Runtime ART and its debugging tools. The notes cover the format of Dex files, the ART runtime, and the Hook framework. The notes mention the use of the "oatdump" tool...

CVE-2019-1989

In ih264dfmtconv420spto420p of ih264dformatconv.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-7.0...

Android's Built-in Security Key Now Works With iOS Devices For Secure Login

In April this year, a software update from Google overnight turned all Android phones, running Android 7.0 Nougat and up, into a FIDO-certified hardware security key as part of a push to encourage two-step verification. The feature made it possible for users to confirm their identity when logging...

Tap 'n Ghost Attack Creatively Targets Android Devices

Researchers have created a novel proof-of-concept PoC attack named Tap ‘n Ghost, which targets Near Field Communication NFC-enabled Android smartphones. This allows an attacker to take control of a target phone simply by tricking the victim into placing their handset on a specially crafted surfac...

Android Security Bulletin—June 2019Stay organized with collectionsSave and categorize content based on your preferences.

The Android Security Bulletin contains details of security vulnerabilities affecting Android devices. Security patch levels of 2019-06-05 or higher address all of these issues. To learn how to check a device's security patch level, see How to check and update your Android version. Android partner...

Google Patches Critical Remote Code-Execution Flaws in Android

Google patched four remote code-execution RCE flaws as part of its May Android Security Bulletin. Three of the critical bugs are tied to the System portion of the Android platform architecture, responsible for core apps such as the dialer, email and camera. A fourth critical RCE bug opens the doo...

Google's April Android Security Bulletin Warns of 3 Critical Bugs

Google has fixed three critical remote code execution bugs in its Android operating system, which could allow a remote attacker to hijack a vulnerable system simply by sending a malicious file. The flaws are part of Google’s April Android Security Bulletin, which includes patches for three critic...