CVE-2026-55264

Google Android is affected by a vulnerability in the checkWhetherCallingAppHasAccess function of DownloadProvider.java. This flaw stems from a confused deputy issue, which can lead to local information disclosure . Exploitation does not require additional execution privileges or user interaction....

PT-2026-135686

In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible information leak due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-26417: Externally Controlled Reference to a Resource in Another Sphere

In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for...