CVE-2026-13030: Use of Uninitialized Variable

Uninitialized Use in GPU in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: High...

PT-2026-52055

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.197 Description A use after free issue exists in the WebView component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A...

PT-2026-52050

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.197 Description A use after free issue exists in WebGL, which could allow a remote attacker to potentially perform a sandbox escape by inducing the user to visit a crafted HTML page. A use...

Google Android DDoS Vulnerability (CNVD-2026-26529)

Android is Google's mobile operating system, used for managing the operation of smartphones, tablets, and embedded devices. Google Android has a denial-of-service vulnerability. The vulnerability arises due to a lack of null pointer checking in the checkSsrcCollisionOnRcv function in...

CVE-2026-13032: Use After Free

Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-13028: Use After Free

Use after free in WebGL in Google Chrome on Android prior to 149.0.7827.197 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Chromium security severity: Critical...

PT-2026-52048

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.197 Description An uninitialized use in the GPU component allows a remote attacker to obtain potentially sensitive information from process memory. This is achieved by inducing the victim t...

PT-2026-52046

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 149.0.7827.197 Description A use after free issue exists in WebGL, which could allow a remote attacker to potentially perform a sandbox escape by inducing the user to visit a crafted HTML page. A use...

Improper Export of Android Application Components

Overview Affected versions of this package are vulnerable to Improper Export of Android Application Components via the LocationSensorManager BroadcastReceiver process. An attacker can manipulate zone-based automations by sending a forged location result, causing unauthorized actions such as...

CVE-2026-54318

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services...

CVE-2026-54318

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services...

Exploit for Out-of-bounds Write in Samsung Android

SveService Buffer Overflow portug...

CVE-2026-54318: Improper Export of Android Application Components

Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManager BroadcastReceiver is exported with no permission. Any installed app, with zero runtime permissions, can broadcast a forged Google Play Services...

Google Chrome Graphics Processor Unauthorized Access

The vulnerability of the graphics processor in Google Chrome browsers on Android operating systems is related to the use of uninitialized variables. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information through a specially created HTML page...

KLA91118 Multiple vulnerabilities in Google Chrome

Multiple vulnerabilities were found in Google Chrome. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, obtain sensitive information, cause denial of service. Below is a complete list of vulnerabilities: 1. Race vulnerability in DevTools ca...

Google Sets Sept. 30 Deadline for Android Developer Verification in Four Countries

Google has set September 30, 2026, as the day it begins enforcing Android developer verification in the first four countries, and the major device-maker app stores are in from the start. On that date, certified Android phones in Brazil, Indonesia, Singapore, and Thailand will block normal install...

Exploit for Use After Free in Google Android

CVE-2023-20938 — Android binder UAF privilege escalation A lo...

A week in security (June 15 – June 21)

Last week on Malwarebytes Labs: Nearly 15,000 infected websites cleaned in SocGholish crackdown Apple patches Beats Studio Buds flaw that could turn earbuds into a wiretap Microsoft working on a fix for RoguePlanet, a flaw that grants full PC control Retro gaming fans are the new target for fake...

CVE-2026-KGSL-UAF

CVE-2026-XXXXX — KGSL Syncsource Fence Use-After-Free Sever...

CVE-2025-48640

creationtimestamp| type| source ---|---|--- 2026-06-21 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/android-multiple-vulnerabilities20260622 2026-06-21 21:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=1931 2026-08-01 18:07:06+00:00| seen|...