CVE-2021-39696

CVE-2021-39696 affects Android (10–12) via Task.java, enabling local privilege escalation (confused deputy) with no extra execution privileges; exploitation requires user interaction. CVSS3.1: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 7.8 (High). The vulnerability is documented in Android s...

CVE-2021-39797

CVE-2021-39797 affects Google Android 12/12L and is tied to a logic error in LauncherApps.java that enables local elevation of privilege. The issue can be exploited locally without user interaction, granting higher privileges due to a flawed control path in several LauncherApps functions. The vul...

CVE-2022-20344

CVE-2022-20344 describes a race condition in Android’s EventThread.cpp (stealReceiveChannel) that could allow interference with process communication, enabling local escalation of privilege without requiring extra execution privileges. Affected: Android-10, Android-11, Android-12, Android-12L. Im...

CVE-2022-20352

The CVE-2022-20352 entry refers to a local information-disclosure flaw in Android 12/12L via a missing permission check in LocationManagerService.addProviderRequestListener. It can reveal which packages request location data (information disclosure with no extra execution privileges). Connected s...

CVE-2022-20494

The CVE-2022-20494 issue affects Android (Android 10–13) and involves the AutomaticZenRule component (AutomaticZenRule.java). The described vulnerability is a possible persistent DoS caused by resource exhaustion, enabling a local denial of service with no user interaction required. Impact is lim...

CVE-2023-20904

The CVE-2023-20904 issue is in Android SettingsActivity.getTrampolineIntent, where an Intent mismatch can launch an arbitrary activity. This could enable local privilege escalation without extra privileges or user interaction. Affected: Android-12L and Android-13. According to Android security bu...

CVE-2023-21291

CVE-2023-21291 affects Android’s Notification.java (visitUris in the framework). The vulnerability arises from a missing permission check, potentially allowing a local attacker to reveal image contents belonging to another user. This is described as a local information disclosure with User privil...

CVE-2023-40120

CVE-2023-40120 is an Android elevation-of-privilege issue caused by improper input validation in multiple locations that bypasses user notification of foreground services. The vulnerability enables local escalation of privilege with no user interaction and is exploitable with local access. Public...

CVE-2023-40121

CVE-2023-40121 affects Google Android via a vulnerability in DatabaseUtils.java (appendEscapedSQLString) that enables information disclosure through unsafe deserialization. The description across connected sources notes a SQL injection risk with local impact, requiring local privileges and no use...

CVE-2020-0073

The CVE-2020-0073 entry describes an out-of-bounds write in Android’s NFC processing, specifically in rw_t2t_handle_tlv_detect_rsp within rw_t2t_ndef.cc. The issue allows remote code execution over NFC with no privileges and no user interaction, per the description. Affected products/versions inc...

CVE-2022-20223

CVE-2022-20223 affects Android (10–12/12L). Root cause: an obfuscated proxy in AppRestrictionsFragment.java (assertSafeToStartCustomActivity) may allow starting a phone call without required permissions, due to a confused deputy, enabling local elevation of privilege with no extra execution privi...

CVE-2022-20490

CVE-2022-20490 affects Android devices via the file AutomaticZenRule.java, with a vulnerability caused by resource exhaustion that can cause a failure to persist permissions settings. The impact is a local escalation of privilege, requiring local access with no additional execution privileges and...

CVE-2023-20916

CVE-2023-20916 affects Android 12 and Android 12L. In the LauncherAppsService.getMainActivityLaunchIntent function, there is a reported bypass of restrictions on starting activities from the background due to a missing permission check. This could enable local elevation of privilege with no addit...

CVE-2023-21107

CVE-2023-21107 describes an elevation-of-privilege flaw in Android where a missing permission check in retrieveAppEntry(NotificationAccessDetails.java) could allow a local attacker to escalate privileges across user boundaries without extra execution privileges or user interaction. Affected are A...

CVE-2023-21110

The CVE 2023-21110 entry documents an elevation-of-privilege in Android related to SnoozeHelper.java, enabling a local attacker to gain notification access due to resource exhaustion. Affected products include Android 11, 12, and 12L/13, with a local-exploit path that does not require user intera...

CVE-2024-43770

CVE-2024-43770 stems from a missing bounds check in the Bluetooth GATT server path (gatts_process_find_info in gatt_sr.cc), causing an out-of-bounds write. This can enable remote code execution on Android devices with no user interaction and without extra privileges. The issue is classified as a ...

CVE-2015-9016

CVE-2015-9016 : In the upstream Linux kernel, the use-after-free race in blk_mq_tag_to_rq (blk-mq.c) can occur when a request was already freed by blk_mq_complete_request . This race enables local escalation of privilege on affected systems, with the Android kernel explicitly mentioned as impacte...

CVE-2023-40122

CVE-2023-40122 : Affected component is Android’s SaveUi.java (applyCustomDescription). The issue enables a confused deputy to disclose another user’s images via local information disclosure, requiring no additional execution privileges and no user interaction. This is a local vulnerability; no re...

CVE-2024-40649

Technical details (affected product, version, root cause, exploitability) are not publicly available in the provided documents; monitor for updates.

CVE-2021-39670

CVE-2021-39670: In Android, the setStream method of WallpaperManager.java can trigger a permanent DoS via improper input validation, requiring local access and no user interaction. Affected: Android 12 and Android 12L (Android ID A-204087139). The issue is described across multiple sources (NVD/N...

CVE-2021-39691

CVE-2021-39691 describes a tapjacking risk in Android’s WindowManager caused by an incorrect window flag when processing user input, enabling a local elevation of privilege with user interaction required. Affected: Android 10–12. Exploitation would be local; no remote access indicated. The issue ...

CVE-2021-39804

CVE-2021-39804 describes a DoS in Google Android, caused by a missing null check in the reinit path of HeifDecoderImpl.cpp. The flaw can allow a remote persistent denial of service in the file picker with user interaction required and no extra privileges. Affected products/versions include Androi...

CVE-2022-20496

CVE-2022-20496 affects Android’s media framework via a vulnerability in the setDataSource function of initMediaExtractor.cpp. The issue is caused by a use-after-free, which could allow arbitrary code execution and/or local information disclosure without user interaction. Affected products include...

CVE-2023-21115

CVE-2023-21115: In Android, the vulnerability stems from a weakness in btm_sec_encrypt_change in btm_sec.cc that allows downgrading the link key type due to improper crypto, enabling paired-device elevation of privilege without user interaction. Affected: Android 11, 12, 12L. Status: remediation ...

CVE-2023-21268

CVE-2023-21268 concerns a path traversal issue in the Android MmsProvider.java update that can alter directory permissions. The vulnerability enables a local attacker to trigger a denial of service affecting SIM recognition, without requiring additional execution privileges. Exploitation is descr...

CVE-2016-2431

CVE-2016-2431 affects Android devices with Qualcomm TrustZone prior to 2016-05-01 (notably Nexus 5, Nexus 6, Nexus 7 (2013), and Android One). The issue is an Elevation of Privilege in the Qualcomm TrustZone component that could allow a local attacker via a crafted application to gain privileged ...

CVE-2017-0663

CVE-2017-0663: libxml2 remote code execution via a crafted file. The Android-impacting flaw is a libxml2 out-of-bounds write that can crash or enable code execution in an unprivileged process. Exploitation and impact are stated in the CVE entry, with high severity (CVSSv3 7.8). No public fix vers...

CVE-2020-0110

CVE-2020-0110 affects the Android kernel, with the issue located in psi_write of psi.c. The flaw is an out-of-bounds write caused by a missing bounds check, enabling local privilege escalation without required user interaction. The available documents do not specify exploit details, affected vers...

CVE-2021-0318

CVE-2021-0318 affects Android and is tied to SensorEventConnection.cpp, where a use-after-free can cause an out-of-bounds write. This leads to local escalation of privilege with no extra execution privileges required and no user interaction. Documented impact covers Android versions 8.1, 9, 10, a...

CVE-2021-0870

CVE-2021-0870 describes a memory corruption race condition in RW_SetActivatedTagType (rw_main.cc) that could allow remote code execution with no privileges required and no user interaction. Affected: Android 9, 10, 11, and 8.1. CVSSv3 base score 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Public r...

CVE-2021-39635

CVE-2021-39635 concerns Unisoc’s ims_ex, a vendor system service used to manage VoLTE on Android devices. The root cause is that ims_ex does not verify the caller’s permissions, allowing normal apps without phone permissions to access VoLTE‑sensitive information and to manage VoLTE calls. Various...

CVE-2022-20480

The CVE-2022-20480 issue affects Android’s NotificationChannel.java, where a risk of failing to persist permissions settings can occur due to resource exhaustion. This leads to local elevation of privilege without extra execution privileges required, and exploitation is user interaction–independe...

CVE-2022-20482

CVE-2022-20482 affects Android 12, 12L, and 13, specifically the NotificationManager.java createNotificationChannel path. The vulnerability stems from a resource exhaustion condition that can be triggered locally, without user interaction, to make the device unusable and potentially require a fac...

CVE-2022-20485

CVE-2022-20485 affects Android’s NotificationChannel.java across Android 10–13 (including 12L/12) and is due to a resource-exhaustion path that can fail to persist permissions settings. The issue enables local elevation of privilege with no extra execution privileges required and no user interact...

CVE-2023-20919

CVE-2023-20919 affects Android 13 (Settings.java: getStringsForPrefix). A logic error could prevent package uninstallation, enabling local elevation of privilege with no user interaction. CVSS v3.1: Local attacker, low privileges, no user interaction, high confidentiality/ integrity/ availability...

CVE-2023-20932

CVE-2023-20932 affects Android 10–13 where, in the onCreatePreferences method of EditInfoFragment.java, improper input validation could allow reading contacts belonging to other users. This is an information-disclosure vulnerability with local access and no required user interaction. The issue is...

CVE-2023-40140

CVE-2023-40140: Android component android_view_InputDevice_create (android_view_InputDevice.cpp) has a use-after-free vulnerability that can lead to arbitrary code execution and local escalation of privilege. Impact is local, with no user interaction required. The Android Security Bulletin notes ...

CVE-2024-40677

CVE-2024-40677 concerns the Android shouldSkipForInitialSUW path in AdvancedPowerUsageDetail.java. The issue enables bypassing factory reset protections via a missing permission check, enabling local elevation of privilege with no extra execution privileges required and no user interaction needed...

CVE-2021-39805

The CVE-2021-39805 issue affects Android 12/12L where the l2cble_process_sig_cmd function in l2c_ble.cc may trigger an out-of-bounds read due to a missing bounds check, enabling remote information disclosure over Bluetooth without user interaction. Available details indicate the vulnerability exi...

CVE-2022-20396

CVE-2022-20396 affects SettingsActivity.java on Android 12L and 13, where a permissions bypass could allow a device to be discovered over Bluetooth without user interaction or required permissions. This enables local elevation of privilege with no additional execution privileges needed, and explo...

CVE-2022-20449

CVE-2022-20449 affects Android 10–13, in the writeApplicationRestrictionsLAr path, where a path traversal flaw could overwrite system files, enabling local DoS with system privileges and no user interaction. Exploitation specifics are not detailed in the provided documents. Android bulletins note...

CVE-2022-20466

CVE-2022-20466 describes a local information-disclosure flaw in Android where applyKeyguardFlags in NotificationShadeWindowControllerImpl.java could allow observing the user’s password on a secondary display due to an insecure default value. The issue affects Android 10–13 (Android-10, Android-11...

CVE-2023-21088

The CVE affects Android (Android-12, Android-12L, Android-13) via a logic error in LocationProviderManager.java’s deliverOnFlushComplete, enabling bypass of background activity launch restrictions and leading to local elevation of privilege without extra privileges or user interaction. Affected c...

CVE-2023-21272

CVE-2023-21272 concerns an elevation of privilege in Android via the readFrom path in the Uri.java implementation. The vulnerability arises from improper input validation in Uri.readFrom, enabling a possible bad URI permission grant with local impact and no extra execution privileges required. Re...

CVE-2024-34727

CVE-2024-34727 describes an out-of-bounds read caused by a heap buffer overflow in sdpu_compare_uuid_with_attr (sdp_utils.cc), enabling remote information disclosure with no privileges and no user interaction. Public details come from Android/Blueprints and Red Hat CVE records; the Android Securi...

CVE-2021-0646

CVE-2021-0646 affects Android via an out-of-bounds write in sqlite3_str_vappendf (sqlite3.c) caused by improper input validation. This could enable local privilege escalation if an attacker can inject a printf into a privileged process' SQL; exploitation does not require user interaction. Android...

CVE-2021-39616

CVE-2021-39616 affects Android via the Unisoc component sprd-vowifi; listed as High severity in the 2022-02-05 Android bulletin under Unisoc components. The provided documents do not include exploit details or a specific patched version. No root-cause or impact outside the stated classification i...

CVE-2022-20473

CVE-2022-20473 is an Android Framework vulnerability caused by an out-of-bounds read in LocaleListCache.cpp:toLanguageTag, stemming from an incorrect bounds check. This can enable remote code execution without user interaction on affected builds. Public details confirm impact across Android-10, A...

CVE-2022-20497

CVE-2022-20497 описывает возможность локального раскрытия информации через неправильное состояние в методе updatePublicMode в NotificationLockscreenUserManagerImpl.java на Android 12–13 (Android-12, Android-12L, Android-13). Уязвимость связана с тем, что в результате некорректного перехода состоя...

CVE-2022-20500

CVE-2022-20500 : In ShortcutPackage.java, loadFromXml may crash on boot due to an uncaught exception, causing local denial of service without extra privileges. Affected: Android 10–13. Impact is a local DoS; exploitation requires no user interaction. Mitigation: update Android to a patched build ...