CVE-2019-2193

CVE-2019-2193 affects Android 8.0–10 where a partially provisioned Device Policy Client in WelcomeActivity.java could bypass permissions, enabling local escalation of privilege and leaving an Admin app installed without user notification. Exploitation is described as local with no user interactio...

CVE-2019-2199

CVE-2019-2199 affects Android 10, where in PackageInstallerService.java’s createSessionInternal a permissions bypass could enable local elevation of privilege to System level. No exploitation details are provided beyond that; impact is local and requires no user interaction. The Android Security ...

CVE-2019-2211

CVE-2019-2211 involves a SQL injection in TvProvider.java’s createProjectionMapForQuery, enabling local information disclosure without extra privileges on Android 8.0–10. The issue is documented across multiple feeds (NVD, Red Hat, CVE lists, and regional advisories) with a consistent description...

CVE-2019-9235

CVE-2019-9235 affects Android 10 NFC functionality. The issue is an out-of-bounds read caused by a missing bounds check in NFC, enabling local information disclosure with user interaction required for exploitation. Impact is described as partial confidentiality loss with no privilege escalation. ...

CVE-2019-9244

CVE-2019-9244 affects Android 10 devices via the NFC component, where a missing bounds check enables an out-of-bounds read and local information disclosure. The issue requires user interaction to exploit and has a Media/Confidentiality impact (C/H) per the CVE details, with CVSSv3.1 base score 5....

CVE-2019-9282

CVE-2019-9282 affects Google’s Skia library used in Android 10. The issue is an out-of-bounds read due to a missing bounds check, enabling remote information disclosure with no execution privileges and requiring user interaction to exploit. The Android security release notes indicate fixes are pa...

CVE-2019-9292

CVE-2019-9292 affects Android 10’s Activity Manager service, enabling information disclosure via a confused deputy. It could allow local disclosure of the current foreground process without extra privileges, with no user interaction required. Mitigation is to run a device with Android 10 patch le...

CVE-2019-9331

CVE-2019-9331 affects Android 10 Bluetooth: a missing bounds check enables an out-of-bounds read and remote information disclosure without privileges or user interaction. Documented in Android 10 security release notes; mitigated by Android patch level 2019-09-01 or later. Exploitation status and...

CVE-2019-9332

The CVE-2019-9332 entry concerns the Android 10 Bluetooth stack, where a missing bounds check enables an out-of-bounds read. This could allow remote information disclosure without user interaction or privileges, over a network vector (low complexity). The issue is documented in NVD and Red Hat’s ...

CVE-2019-9360

CVE-2019-9360 affects Android 10 on the TEE, with an out-of-bounds read caused by a missing bounds check. This could enable local information disclosure with system-level privileges, without user interaction. Exploitation details are not provided in the documents; mitigations/patches are referenc...

CVE-2019-9377

CVE-2019-9377 affects Android 10: FingerprintService bypasses protections isolating user profiles due to a missing permission check, enabling local information disclosure of biometrics metadata for another user without additional execution privileges. Impact is limited to local information disclo...

CVE-2019-9381

CVE-2019-9381 affects Android’s netd, with an out-of-bounds read caused by a use-after-free. This leads to remote information disclosure without additional privileges or user interaction on Android 10. The available documents confirm the vulnerable component and the impact but do not provide expl...

CVE-2019-9403

CVE-2019-9403: In cn-cbor, an out-of-bounds read due to improper casting could lead to remote information disclosure on Android 10. Impact is information disclosure with no privileges gained; exploitation requires user interaction. CVSS2 base 4.3 (PARTIAL confidentiality impact) and CVSS3.1 base ...

CVE-2020-0038

CVE-2020-0038 affects Android devices (Android 8.0–10) due to a missing bounds check in rw_i93_sm_update_ndef of rw_i93.cc , which can cause a read of uninitialized data and lead to remote information disclosure without additional execution privileges or user interaction. The available documents ...

CVE-2020-0091

CVE-2020-0091 affects the MediaTek mnld component; description in the initial docs notes an incorrect configuration in driver_cfg of mnld for meta factory mode. The entry is listed under Android/Microsoft 2020-05 release details as a High severity issue for the MediaTek mnld in the 2020-05-01 sec...

CVE-2020-0092

CVE-2020-0092 affects Android 10 and is described as a local information-disclosure vulnerability in the NotificationStackScrollLayout (setHideSensitive). The root cause is a permissions bypass that could disclose sensitive notification content; exploitation requires user interaction. Impact is p...

CVE-2020-0135

CVE-2020-0135 affects Android 10, where in RollbackManagerServiceImpl.java a missing permission check can cause backup metadata exposure, enabling local information disclosure with System privileges (no user interaction required). The issue is documented across multiple sources (NVD/Red Hat/PRION...

CVE-2020-0136

CVE-2020-0136 affects Android 10, with an out-of-bounds write in Parcel.cpp caused by an integer overflow, enabling local privilege escalation in the system server without extra execution privileges or user interaction. Documents consistently describe the issue as a local elevation of privilege v...

CVE-2020-0156

CVE-2020-0156 affects Android 10 and points to an out-of-bounds read in the NxpNfc::ioctl path of NxpNfc.cpp caused by a missing bounds check. The issue enables local information disclosure with user privileges; exploitation does not require user interaction but is local in nature. CVSS metrics i...

CVE-2020-0179

CVE-2020-0179 concerns a path traversal vulnerability in Android’s MtpServer.cpp (doSendObjectInfo) caused by insufficient input validation. The issue can enable local privilege escalation with no extra privileges required; exploitation requires user interaction. Affected product: Android 10. The...

CVE-2020-0209

CVE-2020-0209 affects Android 10 Framework (AccountManager.java). Description: permissions bypass in multiple AccountManager functions could enable local elevation of privilege without additional execution privileges required; exploitation requires no user interaction. Evidence across documents s...

CVE-2020-0272

CVE-2020-0272 affects Android 11 components: libhwbinder. The bug is described as an information disclosure caused by uninitialized data in libhwbinder, enabling local information disclosure with system privileges; no user interaction is required. Connected sources (Red Hat, NVD, CVE lists, NCSC)...

CVE-2020-0277

Summary (CVE-2020-0277) : The vulnerability affects Android 11 in the NetworkPolicyManagerService . It arises from a missing permission check , allowing a local attacker to perform a permissions bypass and achieve local elevation of privilege to modify the device’s data plan without any extra exe...

CVE-2020-0308

CVE-2020-0308 affects the Android 11 Window Manager. The root cause is an unsafe PendingIntent that enables a permission bypass, allowing local information disclosure without user interaction. Vulnerable component: Window Manager (Android-11). Impact: information disclosure with user privileges; ...

CVE-2020-0315

CVE-2020-0315 affects Android 11, specifically Zen Mode, where an unsafe PendingIntent can bypass permissions to cause local information disclosure without user interaction. Root cause: unsafe PendingIntent in Zen Mode. Impact: information disclosure with Android-11 user privileges; CVSS details ...

CVE-2020-0321

CVE-2020-0321 affects Android 11, involving the MP3 extractor in the Media Framework where an out-of-bounds write due to uninitialized data can lead to remote code execution. Exploitation requires user interaction and is conveyed as a high-severity issue (Android 11 Security Release Notes; CVSS d...

CVE-2020-0475

CVE-2020-0475 affects Android 11 where in WindowManagerService.createInputConsumer there is a missing permission check, enabling a local elevation of privilege by intercepting input events. Exploitation requires user interaction; no remote access assumed. Public sources (Red Hat, NVD, CVE lists) ...

CVE-2020-10854

CVE-2020-10854 concerns information disclosure on Samsung mobile devices running O(8.x), P(9.0), or Q(10.0) software, where kernel stack addresses are leaked to userspace. The issue affects the kernel exposure path and is classified with a high impact in CVSS 3.1 (base score 7.5) and medium in CV...

CVE-2020-11874

CVE-2020-11874 concerns LG mobile devices running Android 8.x–10, where attackers can bypass Factory Reset Protection (FRP). The LG internal ID is LVE-SMP-200004 (March 2020). Connected sources (NVD, Red Hat advisory, CVE listings) corroborate the FRP bypass claim. The documents do not provide co...

CVE-2020-12748

CVE-2020-12748 affects Samsung mobile devices running Q(10.0); attackers can bypass the locked-state protection to designate a different preferred SIM card. Root cause details are not provided in the documents. Remediation is indicated via Samsung security update SVE-2020-16594; apply the vendor-...

CVE-2020-12751

CVE-2020-12751 affects Samsung mobile devices running O(8.X), P(9.0), and Q(10.0). The Quram image codec library is vulnerable to memory overwrite via crafted JPEG data during decoding, enabling arbitrary code execution on impact. Public sources (NVD, Red Hat, CNVD, and related CVE records) consi...

CVE-2020-25048

CVE-2020-25048 affects Samsung mobile devices running Q(10.0) with ONEUI 2.1. In the lockscreen state, the Quick Share feature can perform unauthenticated downloads, enabling file injection. This is tied to Samsung ID SVE-2020-17760 (Aug 2020). The NVD entry provides CVSS metrics (2.1/2.0) and a ...

CVE-2020-25062

CVE-2020-25062 describes a privilege-bypass in LGTelephonyProvider on LG Android devices (9/10). Affected product: LG mobile devices running Android 9–10; root cause: bypass of intended privilege restrictions in LGTelephonyProvider (LG internal ID LVE-SMP-200017). Impact is reported as high to cr...

CVE-2020-27028

CVE-2020-27028 affects Android 11 and relates to an out-of-bounds read in filter_incoming_event of hci_layer.cc due to a missing bounds check. This can enable local information disclosure with system-level privileges, and does not require user interaction to exploit. The issue is documented acros...

CVE-2020-27036

CVE-2020-27036 is a local elevation-of-privilege issue in Android 11’s NFC stack. The vulnerability occurs in phNxpNciHal_send_ext_cmd implemented by phNxpNciHal_ext.cc, where a missing bounds check enables an out-of-bounds write. This could lead to local escalation of privilege on the NFC server...

CVE-2020-27046

CVE-2020-27046 affects Android 11 (per initial description). The issue is in nfc_ncif_proc_ee_action of nfc_ncif.cc, where a missing bounds check allows an out-of-bounds read that can lead to local information disclosure with system-level privileges. Exploitation requires no user interaction. NVD...

CVE-2021-0385

CVE-2021-0385 affects Android 11, specifically the ConnectToNetworkNotificationBuilder.java path (createConnectToAvailableNetworkNotification). The issue allows a local elevation of privilege via connection to untrusted Wi‑Fi networks triggered by notification interaction above the lockscreen, wi...

CVE-2021-0387

CVE-2021-0387 affects Android 11 with a race-condition caused use-after-free in FindQuotaDeviceForUuid (QuotaUtils.cpp). This leads to local elevation of privilege to System level. Exploitation details are not provided in the sources; MITRE ATT&CK IDs are not justified in the documents. Remediati...

CVE-2021-0389

CVE-2021-0389 affects Android 11; root cause is a missing permission check in UiModeManagerService.setNightModeActivated (UiModeManagerService.java). This permits local privilege escalation without additional execution privileges and without user interaction. Public information confirms the issue...

CVE-2021-0412

The CVE-2021-0412 issue affects the MediaTek flv extractor and is caused by a missing bounds check that enables an out-of-bounds read. This leads to local information disclosure without additional execution privileges. Documents note no user interaction is required for exploitation. A patch is re...

CVE-2021-0414

The CVE-2021-0414 entry relates to MediaTek’s flv extractor, where a heap buffer overflow can cause an out-of-bounds read. This may lead to local information disclosure without requiring user interaction. The available patch/issue identifiers are ALPS05561384 (Patch ID) and ALPS05561384 (Issue ID...

CVE-2021-0416

CVE-2021-0416 concerns the Mediatek memory management driver. The available descriptions state a vulnerability due to improper input validation that can cause a system crash, yielding local denial of service without requiring user interaction. Affected components are described as the memory manag...

CVE-2021-0452

The CVE-2021-0452 entry concerns the Titan M chip firmware. It describes a stack memory disclosure due to uninitialized data, enabling local information disclosure with system privileges required. Exploitation is described as local with no user interaction needed. The issue is tied to Android ker...

CVE-2021-0458

CVE-2021-0458 affects the FingerTipS touch screen driver in the Android kernel. The issue is an out-of-bounds read caused by an integer overflow in the driver, which can lead to local information disclosure with System privileges required. Exploitation does not require user interaction. Public de...

CVE-2021-0495

CVE-2021-0495 : In Android, a memory management driver has an out-of-bounds write due to uninitialized data, enabling local elevation of privilege. Exploitation is Local with no user interaction required; no explicit exploit details or patch versions are provided in the connected documents.

CVE-2021-0625

CVE-2021-0625 affects MediaTek’s ccu (camera control processor). The Red Hat/NVD entries describe memory corruption due to improper locking, enabling local escalation of privilege with System execution privileges required and no user interaction. The vulnerability impact is stated as local, with ...

CVE-2021-0631

The CVE-2021-0631 entry concerns the Mediatek wifi driver with a missing bounds check in the wifi driver, causing a possible system crash and remote denial of service without authentication or user interaction. The issue is described as a missing bounds check that can be exploited to crash the sy...

CVE-2021-0666

CVE-2021-0666 concerns MediaTek’s Apusys component where an incorrect bounds check can cause an out-of-bounds read. This leads to local information disclosure with system execution privileges needed to exploit, and does not require user interaction. The vulnerability is documented across multiple...

CVE-2021-0669

In apusys, the vulnerability is a memory corruption due to a use-after-free, enabling local escalation of privilege with SYSTEM execution privileges required and no user interaction. The CVE entry notes this affects the apusys component and lists patch ID ALPS05681550 / Issue ID ALPS05681550 as t...

CVE-2021-0896

CVE-2021-0896 affects the MediaTek Apusys component (apusys): a missing bounds check allows an out-of-bounds write, enabling local escalation of privilege with System execution privileges. User interaction is not required. The issue is documented across NVD and Red Hat entries; the cited patch is...