PT-2026-77323

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.169 Description A buffer overflow exists in Dawn, which allows a remote attacker to execute arbitrary code outside the sandbox by inducing the user to visit a specially crafted HTML page. A...

PT-2026-76984

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description Clickjacking issue in Firefox for Android. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a button or li...

PT-2026-77013

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description A clickjacking issue exists in the Downloads component. Clickjacking is a technique where an attacker uses multiple transparent or semi-transparent layers to trick a user into clicking on a...

PT-2026-77008

Name of the Vulnerable Software and Affected Versions Firefox for Android versions prior to 154 Description A spoofing issue exists within the Downloads component, which could allow an attacker to deceive users by misrepresenting the source or nature of a downloaded file. Recommendations Update t...

CVE-2026-76036: Heap-based Buffer Overflow

Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-76039: Use of Incorrectly-Resolved Name or Reference

Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium security severity: High...

CVE-2026-74951: Improper Restriction of Rendered UI Layers or Frames

Clickjacking issue in Firefox for Android. This vulnerability was fixed in Firefox 154...

CVE-2026-74980: Improper Restriction of Rendered UI Layers or Frames

Clickjacking issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

PT-2026-77243

Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.5.1 Description The find icon path zip function in mobsf/StaticAnalyzer/views/android/icon analysis.py fails to properly validate the android:icon value from the Android manifest. This allows an authenticated user to...

PT-2026-77246

Name of the Vulnerable Software and Affected Versions MobSF versions prior to 4.5.1 Description An authenticated user can upload a crafted APK to trigger requests to an attacker-selected nonstandard port at /.well-known/assetlinks.json. This occurs because the get browsable activities function in...

CVE-2026-74975: User Interface (UI) Misrepresentation of Critical Information

Spoofing issue in the Downloads component in Firefox for Android. This vulnerability was fixed in Firefox 154...

PT-2026-77333

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 151.0.7922.169 Description A buffer overflow exists in ANGLE, a compatibility layer that allows OpenGL ES APIs to run on non-native platforms. This issue allows a remote attacker who has already...

Malicious code in socks5901 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3 During import, package exfiltrates all files from "/sdcard/" --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-14100 Malicious code in socks5901 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3 During import, package exfiltrates all files from "/sdcard/" --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Exploit for Incorrect Authorization in Qualcomm Aqt1000_Firmware

Neo9Root iQOO Neo9 PD2338C Unlocked Without Unlocking –...

Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access

Security researchers at SSD Secure Disclosure have published a two-stage exploit chain that achieves full Android kernel access on devices running Unisoc modem firmware through a VoLTE video call, with no fix from the chipset maker. The advisory, published August 17, 2026, is the second stage of ...

CVE-2026-19978

A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function childprocess.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument...

CVE-2026-19978

CVE-2026-19978 affects jiantao88 android-mcp-server. The vulnerability is in the function child_process.exec within the file build/index.js of the Command Execution component. An attacker can manipulate arguments such as deviceId , packageName , permission , and extras[].key/value to trigger OS c...

CVE-2026-19978

A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function childprocess.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument...

CVE-2026-19978 jiantao88 android-mcp-server Command Execution index.js child_process.exec os command injection

A flaw has been found in jiantao88 android-mcp-server up to cfb872b2446794193b58edd63f4dbf6af48a6292. The impacted element is the function childprocess.exec of the file build/index.js of the component Command Execution. Executing a manipulation of the argument...