CVE-2026-28666

CVE-2026-28666 affects Android (identified via ASB-A-501447778 and the 2026-09-01 Android Security Bulletin). The vulnerability resides in multiple functions of LocalImageResolver.java , where a DNG image rendering check bypass enables a Remote Persistent Denial of Service that can escalate to re...

CVE-2026-28664

CVE-2026-28664 affects Android , specifically the WriteImageToDisk function in runtime_image.cc . A logic error in this function permits file tampering, which can lead to local privilege escalation requiring only low privileges and no user interaction. The CNA-assigned CVSS 3.1 score is 7.8 (HIGH...

CVE-2026-28663

CVE-2026-28663 affects Android in the buildIntentSenderForUser function of LauncherAppsService.java . The root cause is a Background Activity Launch (BAL) bypass , allowing a malicious app to launch an activity from the background. This enables local privilege escalation with low privileges requi...

CVE-2026-28662

CVE-2026-28662 is a heap buffer overflow in the p2p_process_prov_disc_bootstrap_req function of p2p_pd.c within the Android P2P (Wi-Fi Direct) stack . The out-of-bounds write can lead to remote code execution from an adjacent network with low privileges and no user interaction required. The vulne...

CVE-2026-28660

CVE-2026-28660 is a local information disclosure vulnerability in the Android Framework component, caused by a confused deputy due to a logic error in the getAllSessions function across multiple files (AOSP bug A-498588487 ). A local attacker with low privileges can exploit it without user intera...

CVE-2026-28658

CVE-2026-28658 is a local privilege escalation vulnerability in the findMetaAuthUid function of AccountsDb.java within the Android platform, caused by a logic error that allows a file resource protection (FRP) bypass . An attacker with low local privileges can exploit it without user interaction,...

CVE-2026-28657

CVE-2026-28657 is a local escalation of privilege vulnerability in Android , specifically in the onActivityResult method of AppWidgetConfigActivityProxy.java. The root cause is a confused deputy flaw that allows an unauthorized URI permission grant . Exploitation requires only low privileges, no ...

CVE-2026-28656

This vulnerability affects DeviceAdminAdd.java in Android Wear (disclosed in the 2026-09-01 security bulletin). Multiple functions are susceptible to a tapjacking/overlay attack , allowing a local escalation of privilege with only low privileges and user interaction required. The CVSS 3.1 score i...

CVE-2026-28655

CVE-2026-28655 is a logic error in multiple functions of RemoteViews.java within the Android framework that permits a background activity launch bypass , enabling local privilege escalation. Exploitation requires low privileges , no user interaction, and no additional execution rights, yet can re...

CVE-2026-28653

CVE-2026-28653 is an integer overflow vulnerability in multiple functions of rw_t3t.cc , an Android media framework component responsible for T3T codec handling. The overflow leads to an out-of-bounds write , enabling local privilege escalation with no additional execution privileges or user inte...

CVE-2026-28652

CVE-2026-28652 affects the Ultra-Wideband (UWB) component of Android, specifically multiple functions in RangingServiceImpl.java . The vulnerability is a missing permission check in ranging data parsing that enables a possible man-in-the-middle (MITM) attack, resulting in remote information discl...

CVE-2026-28650

CVE-2026-28650 is a local elevation of privilege vulnerability in Android's WindowState.java (setHiddenWhileSuspended function), caused by a logic error enabling an overlay bypass . No additional execution privileges or user interaction are required. It scores CVSS 7.8 (High) with impacts to conf...

CVE-2026-28644

CVE-2026-28644 is a permission bypass due to a confused deputy in startNextMatchingActivity of ActivityTaskManagerService.java (Android System). It allows local privilege escalation with no additional execution privileges and no user interaction, rated CVSS 7.8 (High) with full impact to confiden...

CVE-2026-28642

CVE-2026-28642 is a high-severity (CVSS 7.8) local privilege escalation vulnerability in Android's ActivityStarter.java (method executeRequest), caused by a logic error that permits an unauthorized background activity launch. Exploitation requires low privileges and no user interaction , with hig...

CVE-2026-28639

CVE-2026-28639 is an out-of-bounds write vulnerability in rw_mfc_handle_read_op of rw_mfc.cc in the Android system framework, caused by a logic error. It enables local privilege escalation with no additional execution privileges and no user interaction. The CNA-assigned CVSS v3.1 score is 7.8 (HI...

CVE-2026-28638

CVE-2026-28638 is an information disclosure flaw in XmpDataParser.java within Android's Media Provider component, caused by improper data sanitization due to a logic error. It allows local disclosure of information without additional privileges or user interaction. The vulnerability affects Andro...

CVE-2026-28636

CVE-2026-28636 affects Android , specifically the setupLayout method in PickActivity.java , where a confused deputy flaw allows a bypass of the "Install unknown apps" security restriction. An attacker with local access and no additional execution privileges can achieve local escalation of privile...

CVE-2026-28634

This local elevation of privilege vulnerability exists in handleUssdRequest of PhoneInterfaceManager.java in the Android Telephony framework. A logic error allows a malicious app to send a USSD request without the required permission, enabling privilege escalation with only low privileges and no ...

CVE-2026-28633

CVE-2026-28633 is a persistent denial of service vulnerability in the initForUserNoTracing method of VoiceInteractionManagerService.java , part of the Android Framework. The root cause is resource exhaustion , which can lead to local denial of service requiring only low privileges and no user int...

CVE-2026-28631

CVE-2026-28631 is a consent bypass vulnerability in Android's IntentForwarderActivity.java (specifically the buildMiniResolver method), exploitable via a tapjacking/overlay attack . The flaw allows local escalation of privilege without additional execution privileges and without user interaction....

CVE-2026-28630

CVE-2026-28630 affects the onCreate method of ContactsPickerActivity.kt in the Android framework, where a tapjacking/overlay attack can produce a misleading user interface, enabling local information disclosure with low privileges and no user interaction. The CVSS 3.1 score is 3.3 (Low) . CISA's ...

CVE-2026-28627

CVE-2026-28627 is a vulnerability in Android's Bluetooth stack , specifically in the btm_sec_encrypt_change function of btm_sec.cc. A logic error enables a downgrade attack , allowing remote information disclosure without additional privileges or user interaction. The CVSS 3.1 score is 4.3 (Mediu...

CVE-2026-28626

CVE-2026-28626 is an Intent redirection vulnerability in the onCreate method of SetupPassthroughActivity.java within the Android platform. An attacker with local access can launch an arbitrary activity, potentially enabling local privilege escalation without additional execution privileges, thoug...

CVE-2026-28624

CVE-2026-28624 is a confused deputy vulnerability in the Android platform that allows read/write access to files without proper permissions , enabling local escalation of privilege with no additional execution privileges and no user interaction. It carries a CVSS 3.1 score of 7.8 (HIGH) with high...

CVE-2026-15396

CVE-2026-15396 is an HTTP request smuggling vulnerability in IBM WebSphere Application Server (versions 8.5 and 9.0) and IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8), caused by improper parsing of the HTTP transfer-encoding request header (CWE-444). A remote, unau...

CVE-2026-10841

CVE-2026-10841 is an HTTP request smuggling vulnerability (CWE-444) affecting IBM WebSphere Application Server 8.5, 9.0, and Liberty (versions 17.0.0.3 through 26.0.0.8 for Liberty). The root cause is inconsistent interpretation of HTTP requests, allowing a remote authenticated low-privilege atta...

CVE-2026-15412

CVE-2026-15412 is an open redirect vulnerability (CWE-601) in IBM WebSphere Application Server (versions 9.0.0.0–9.0.5.28 and 8.5.0.0–8.5.5.30) and IBM WebSphere Application Server Liberty (versions 17.0.0.3–26.0.0.8). A remote, unauthenticated attacker can persuade a victim to visit a specially ...

CVE-2026-11548

CVE-2026-11548 is an HTTP request smuggling vulnerability affecting IBM WebSphere Application Server (versions 9.0 prior to 9.0.5.29 and 8.5 prior to 8.5.5.31) and WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8). The flaw is classified as CWE-444 (Inconsistent Interpreta...

CVE-2026-28623

CVE-2026-28623 is a missing permission check in the writeToParcel method of BleRssiRangingCapabilities.java within Android's Ultra-Wideband (UWB) component. The flaw allows a local application with low privileges to obtain the device's Bluetooth MAC address , resulting in local information disclo...

CVE-2026-11549

CVE-2026-11549 is a virtual host bypass vulnerability affecting IBM WebSphere Application Server (versions 8.5.0.0 through 8.5.5.30 and 9.0.0.0 through 9.0.5.28) and IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8). The flaw is classified as CWE-284: Improper Access C...

CVE-2026-11722

CVE-2026-11722 is an HTTP request smuggling vulnerability (CWE-444) affecting IBM WebSphere Application Server (versions 9.0 and 8.5) and IBM WebSphere Application Server Liberty (versions 17.0.0.3 through 26.0.0.8). IBM rates it CVSS 6.5 (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N), indicating a networ...

CVE-2026-15634

CVE-2026-15634 is an HTTP request smuggling vulnerability (CWE-444) in IBM WebSphere Application Server (traditional, prior to 9.0.5.29 and 8.5.5.31) and IBM WebSphere Application Server Liberty (17.0.0.3 through 26.0.0.8). The root cause is improper parsing of the HTTP transfer-encoding request ...

CVE-2026-28622

CVE-2026-28622 affects the Media Provider component in Android's Project Mainline, specifically in getQueryBuilderInternal of MediaProvider.java. A permissions bypass allows retrieval of location metadata , resulting in local information disclosure with no additional execution privileges or user ...

CVE-2026-28620

CVE-2026-28620 is a permissions bypass in multiple locations that allows unauthorized URI access , leading to local escalation of privilege with no additional execution privileges required and no user interaction. The vulnerability is tracked in the Android Security Bulletin (2026-09-01) and the ...

CVE-2026-28618

CVE-2026-28618 is a heap buffer overflow (OOB write) in the dec_frm_prepare function of oapv.c , part of the Android Media Framework . It can lead to remote code execution with no additional privileges and no user interaction required. The vulnerability is rated CVSS 8.8 (High) and classified as ...

CVE-2026-28617

CVE-2026-28617 affects the WiFi subcomponent of Android's Project Mainline, specifically in WifiNetworkSuggestionsManager.java . The root cause is a persistent denial-of-service due to resource exhaustion , enabling a local attacker to degrade device availability without requiring additional priv...

CVE-2026-28616

CVE-2026-28616 is a vulnerability in the Android Setup Wizard component. Due to a confused deputy flaw, a local attacker can force the device to connect to a malicious network, enabling local escalation of privilege without requiring additional execution privileges or user interaction. The CVSS 3...

CVE-2026-28614

CVE-2026-28614 is a confused deputy vulnerability in the onCreate method of SlicePermissionActivity.java on Android, enabling a local escalation of privilege with no additional execution privileges and no user interaction. The CVSS 3.1 score is 7.8 (HIGH) with high impact to confidentiality, inte...

CVE-2026-28613

CVE-2026-28613 affects Android (per the Android Security Bulletin 2026-09-01 ). The vulnerability resides in the initAppLinkTypeAndIntent function of ChannelImpl.java , where improper input validation allows an arbitrary intent to be launched , leading to local privilege escalation with no additi...

CVE-2026-28612

CVE-2026-28612 is a local escalation of privilege vulnerability in Android's ActivityStarter.java (specifically the resolveActivity method), caused by a logic error that enables Intent Redirection attacks. No additional execution privileges or user interaction are required to exploit it, yielding...

CVE-2026-28611

CVE-2026-28611 is a vulnerability in Android's NfcService.java where a missing permission check in multiple functions enables a silent NFC payment session hijacking , leading to local privilege escalation with no additional execution privileges or user interaction required. The CVSS 3.1 score is ...

CVE-2026-28609

CVE-2026-28609 is an out-of-bounds write vulnerability in MatroskaExtractor.cpp , caused by improper casting during a read operation. It can lead to remote code execution with low privileges required and no user interaction needed, rated CVSS 8.8 (HIGH) . The vulnerability is tracked in the Andro...

CVE-2026-28607

CVE-2026-28607 is a local elevation of privilege vulnerability in the Android Framework component, caused by a background activity launch bypass due to a confused deputy in multiple functions across multiple locations. No additional execution privileges or user interaction are required for exploi...

CVE-2026-28606

CVE-2026-28606 is a logic error in the handleBondStateChanged method of Android's AdapterService.java , which allows an attacker to skip Bluetooth pairing and achieve remote escalation of privilege without user consent, without additional execution privileges, and without user interaction. The CN...

CVE-2026-28604

CVE-2026-28604 is a use-after-free vulnerability in the adbd (Android Debug Bridge Daemon) component of Android, caused by a race condition in multiple locations. It permits remote code execution with no additional privileges and no user interaction. Affected versions include Android 13, 14, 15, ...

CVE-2026-28603

CVE-2026-28603 is a local escalation of privilege vulnerability in the Android system component AppRestrictionsFragment.java, specifically in the assertSafeToStartCustomActivity method. The root cause is a confused deputy flaw that permits read/write access to private files. Exploitation requires...

CVE-2026-28602

CVE-2026-28602 is a logic error in ClipboardService.java (method setClipboardAccessNotificationsEnabledForUser) within the Android Framework component that can break multi-user isolation , leading to local escalation of privilege . No additional execution privileges or user interaction are requir...

CVE-2026-28600

CVE-2026-28600 is a confused deputy vulnerability in the Android payment framework , specifically in the onCreate method of PaymentDefaultDialog.java. An attacker can change the device's default payment app without additional execution privileges or user interaction, enabling a local escalation o...

CVE-2026-28599

CVE-2026-28599 is an Intent Redirection Bypass in the addCreatorToken method of ActivityManagerService.java within the Android Framework component, caused by a logic error . It enables local escalation of privilege with no additional execution privileges and no user interaction required, scored C...

CVE-2026-28596

CVE-2026-28596 is a permanent denial of service vulnerability in the Android Framework component, specifically in the parseInterventionFromXml method of GameManagerService.java. The root cause is resource exhaustion , which can lead to a permanent DoS. Exploitation requires a local attacker with ...