EUVD-2026-74004

In readbootregion of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-45531

CVE-2026-45531 affects Android and is located in the read_boot_region function of fsck.c . The root cause is an out-of-bounds read resulting from a heap buffer overflow , which can lead to local privilege escalation without requiring additional execution privileges or user interaction. The vulner...

CVE-2026-45531

In readbootregion of fsck.c, there is a possible out of bounds read due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-45528

In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

EUVD-2026-74003

In getManageSpaceActivityIntent of StorageManagerService.java, there is a possible LaunchAnyWhere chain due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation...

CVE-2026-45528

CVE-2026-45528 is a vulnerability in Android's StorageManagerService.java , specifically in the getManageSpaceActivityIntent method. The root cause is an unsafe PendingIntent that enables a LaunchAnyWhere chain , allowing local escalation of privilege without requiring additional execution privil...

CVE-2026-45520

CVE-2026-45520 is an Android vulnerability in the onAttach method of BiometricsSettingsBase.java , where a confused deputy condition enables an authentication bypass . An attacker with local, low-privilege access can exploit this without user interaction to achieve local escalation of privilege w...

CVE-2026-45515

In a2dpvendoropusdecoderdecodepacket of a2dpvendoropusdecoder.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28671

CVE-2026-28671 is a race condition in the updateInternal method of MediaProvider.java within Android's Media Provider Project Mainline component. The flaw allows local information disclosure of file contents without requiring additional privileges or user interaction. It affects Android 14, 15, a...

EUVD-2026-73995

In LimitRealloc of malloclimit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28668

In LimitRealloc of malloclimit.cpp, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28668

CVE-2026-28668 is a use-after-free vulnerability in the LimitRealloc function of malloc_limit.cpp , caused by a logic error. It affects Android and is tracked in the September 2026 Android Security Bulletin (ASB-A-501541998). An attacker with low local privileges and no user interaction can explo...

EUVD-2026-73993

In WriteImageToDisk of runtimeimage.cc, there is a possible file tampering due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28664

CVE-2026-28664 affects Android , specifically the WriteImageToDisk function in runtime_image.cc . A logic error in this function permits file tampering, which can lead to local privilege escalation requiring only low privileges and no user interaction. The CNA-assigned CVSS 3.1 score is 7.8 (HIGH...

CVE-2026-28663

In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28658

CVE-2026-28658 is a local privilege escalation vulnerability in the findMetaAuthUid function of AccountsDb.java within the Android platform, caused by a logic error that allows a file resource protection (FRP) bypass . An attacker with low local privileges can exploit it without user interaction,...

EUVD-2026-73989

In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28658

In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28657

CVE-2026-28657 is a local escalation of privilege vulnerability in Android , specifically in the onActivityResult method of AppWidgetConfigActivityProxy.java. The root cause is a confused deputy flaw that allows an unauthorized URI permission grant . Exploitation requires only low privileges, no ...

CVE-2026-28657

In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...