CVE-2026-28650

CVE-2026-28650 is a local elevation of privilege vulnerability in Android's WindowState.java (setHiddenWhileSuspended function), caused by a logic error enabling an overlay bypass . No additional execution privileges or user interaction are required. It scores CVSS 7.8 (High) with impacts to conf...

EUVD-2026-73983

In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73981

In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28642

In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28642

CVE-2026-28642 is a high-severity (CVSS 7.8) local privilege escalation vulnerability in Android's ActivityStarter.java (method executeRequest), caused by a logic error that permits an unauthorized background activity launch. Exploitation requires low privileges and no user interaction , with hig...

EUVD-2026-73980

In rwmfchandlereadop of rwmfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28639

In rwmfchandlereadop of rwmfc.cc, there is a possible out of bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28639

CVE-2026-28639 is an out-of-bounds write vulnerability in rw_mfc_handle_read_op of rw_mfc.cc in the Android system framework, caused by a logic error. It enables local privilege escalation with no additional execution privileges and no user interaction. The CNA-assigned CVSS v3.1 score is 7.8 (HI...

EUVD-2026-73979

In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28638

In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28638

CVE-2026-28638 is an information disclosure flaw in XmpDataParser.java within Android's Media Provider component, caused by improper data sanitization due to a logic error. It allows local disclosure of information without additional privileges or user interaction. The vulnerability affects Andro...

EUVD-2026-73977

In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28634

This local elevation of privilege vulnerability exists in handleUssdRequest of PhoneInterfaceManager.java in the Android Telephony framework. A logic error allows a malicious app to send a USSD request without the required permission, enabling privilege escalation with only low privileges and no ...

CVE-2026-28634

In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28627

In btmsecencryptchange of btmsec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73973

In btmsecencryptchange of btmsec.cc, there is a possible downgrade attack due to a logic error in the code. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28627

CVE-2026-28627 is a vulnerability in Android's Bluetooth stack , specifically in the btm_sec_encrypt_change function of btm_sec.cc. A logic error enables a downgrade attack , allowing remote information disclosure without additional privileges or user interaction. The CVSS 3.1 score is 4.3 (Mediu...

EUVD-2026-73962

In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28612

In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28612

CVE-2026-28612 is a local escalation of privilege vulnerability in Android's ActivityStarter.java (specifically the resolveActivity method), caused by a logic error that enables Intent Redirection attacks. No additional execution privileges or user interaction are required to exploit it, yielding...