CVE-2026-28607

CVE-2026-28607 is a confused deputy vulnerability in the Android Framework component that allows a background activity launch bypass , enabling local elevation of privilege with no additional execution privileges or user interaction required. The associated AOSP bug is A-489225275 , rated High se...

EUVD-2026-73958

In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28606

In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code. This could lead to remote escalation of privilege without user consent with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28606

CVE-2026-28606 is a vulnerability in Android's Bluetooth adapter service, specifically in handleBondStateChanged within AdapterService.java . A logic error allows an attacker to skip the pairing process , resulting in remote escalation of privilege without user consent, no additional execution pr...

CVE-2026-28603

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73956

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28603

CVE-2026-28603 is a local privilege escalation vulnerability in the Android Framework, specifically in the assertSafeToStartCustomActivity method of AppRestrictionsFragment.java. A confused deputy flaw allows read/write access to private files, enabling a locally installed application with low pr...

CVE-2026-28602

In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73955

In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28602

CVE-2026-28602 is a logic error in setClipboardAccessNotificationsEnabledForUser within ClipboardService.java , part of the Android Framework component. The flaw breaks multi-user isolation , enabling a local escalation of privilege with only low privileges required and no user interaction. The N...

EUVD-2026-73954

In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28600

In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28600

CVE-2026-28600 is a confused deputy vulnerability in the onCreate method of PaymentDefaultDialog.java in the Android framework, allowing an attacker to change the default payment app and achieve a local escalation of privilege with no additional execution privileges and no user interaction . It i...

CVE-2026-28599

In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28599

CVE-2026-28599 is an Intent Redirection Bypass in the Android Framework , specifically in addCreatorToken of ActivityManagerService.java, caused by a logic error. It enables local privilege escalation with no additional execution privileges and no user interaction required, rated CVSS 7.8 (High) ...

EUVD-2026-73951

In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28594

In multiple locations, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2026-28594

CVE-2026-28594 is a use-after-free vulnerability in Android due to a logic error in multiple code locations. It enables local privilege escalation requiring only low privileges and no user interaction, with high impact to confidentiality, integrity, and availability (CVSS 7.8 HIGH ). CISA's SSVC ...

CVE-2026-28593

In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-73950

In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...