CVE-2025-48559

CVE-2025-48559 affects Google Android’s AppOpsService.java. The vulnerability arises from improper input validation in multiple internal functions, enabling an attacker to add a large number of app ops. This can cause a local denial of service with no extra privileges and without user interaction...

CVE-2025-48561

Technical details about CVE-2025-48561 are not provided in the connected documents. Monitor for updates.

CVE-2025-48568

CVE-2025-48568 describes a race-condition vulnerability that allows a lockscreen bypass and local escalation of privilege. Reports across multiple sources indicate exploitation could occur with no user interaction and requires only local access, with no additional execution privileges needed. And...

CVE-2025-48570

CVE-2025-48570 involves PipTaskOrganizer.java in Android, where a confused deputy allows launching an activity from the background, enabling local elevation of privilege without extra execution privileges. The CVE is described as a local, high-severity issue (CVSS v3.1: AV:L/AC:L/PR:L/UI:N/S:U/C:...

CVE-2026-0013

CVE-2026-0013 affects the DocumentsUI path in Android (Documents UI, DocumentsUI/Picker flow via PickActivity.setupLayout). The vulnerability allows a confused deputy to start any activity from within a DocumentsUI app, enabling local privilege elevation without extra execution privileges or user...

CVE-2026-0015

CVE-2026-0015 affects Android components, notably multiple locations in AppOpsService.java where improper input validation can cause a persistent, local Denial of Service . Exploitation requires no user interaction and does not grant additional privileges. The Red Hat/NCSC/NVD entries corroborate...

CVE-2026-0036

CVE-2026-0036 describes a tapjacking vulnerability in StageCoordinator.java that could enable local privilege escalation via a tapjacking/overlay attack without user interaction. The issue allows exploitation with local access and is associated with the Android platform (Android Bulletin context ...

CVE-2018-11893

CVE-2018-11893 is a vulnerability in CAF-based Android WLAN code (Linux kernel) where processing a vendor scan request can overflow a buffer when the input length of request IEs exceeds the maximum. The issue is documented across multiple Android CAF releases (Android for MSM, Firefox OS for MSM,...

CVE-2018-11909

CVE-2018-11909 describes an improper access-control issue in CAF-based Android builds (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux kernel, where a device node/executable could be run from /cache/. The connected records do not provide concrete technical details about the vuln...

CVE-2018-5860

CVE-2018-5860 affects the MDSS (multimedia display) driver in Android builds for MSM, Firefox OS for MSM, and QRD Android, provided by CAF on Linux-based kernels. The root cause is that a data structure may be used without proper initialization, as described in multiple sources. According to the ...

CVE-2018-5910

CVE-2018-5910: In CAF-built Android (Android for MSM, Firefox OS for MSM, QRD Android) kernels, memory corruption can occur due to an improper check of the callers count parameter in display handler code. The issue affects the Linux kernel components used by CAF in these Android releases. Root ca...

CVE-2019-2147

CVE-2019-2147 affects the Android libxaac library. The issue is an out-of-bounds read caused by a missing bounds check in libxaac, leading to potential information disclosure. Exploitation requires user interaction, and the vulnerability does not grant additional execution privileges. Connected R...

CVE-2019-2149

CVE-2019-2149 affects the libxaac component in Android 10. The issue is an out-of-bounds read caused by a missing bounds check, leading to potential information disclosure. Exploitation requires user interaction. Multiple sources (Android NVD entry, Red Hat, CNVD, etc.) corroborate this vulnerabi...

CVE-2019-2156

CVE-2019-2156 affects Android 10 where the libxaac library has an out-of-bounds read due to a missing bounds check, enabling potential information disclosure. The vulnerability impacts information confidentiality and requires user interaction to exploit; there is no indication of remote code exec...

CVE-2019-2161

In Android 10, the libxaac library contains an information-disclosure vulnerability caused by a missing bounds check, leading to an out-of-bounds read. It affects Android-10, with exploitation requiring user interaction. Several sources (NVD, Red Hat, CNVD, CVE records) consistently describe this...

CVE-2019-9389

CVE-2019-9389 affects Android 10 Bluetooth stack (Bluetooth component) with a out-of-bounds read due to a missing bounds check. This could lead to remote denial of service without user interaction. CVSSv2 base score 5.0 (NETWORK, LOW attack complexity, no privileges required, Availability impact ...

CVE-2020-0244

CVE-2020-0244 affects Android 11, describing an out-of-bounds read in SPDIFEncoder.cpp (writeBurstBufferBytes) caused by an incorrect bounds check. This can lead to local information disclosure without a clear exfiltration path; exploitation requires user interaction. The NVD entry lists CVSS det...

CVE-2020-0282

Technical details about CVE-2020-0282 are not publicly disclosed in the provided documents. No concrete product/version/exploit information is present beyond the Android-11 NFC bounds issue. Monitor for updates from official advisories.

CVE-2020-10844

CVE-2020-10844 is documented as an out-of-bounds read vulnerability in Samsung mobile devices’ media.audio_policy, affecting O(8.x), P(9.x), and Q(10.0) software. The Samsung internal ID is SVE-2019-16333. The connected Red Hat, CNVD, CNVD-style entries repeat the same description; no product-spe...

CVE-2023-20761

CVE-2023-20761 concerns the ril component with an out-of-bounds write due to a missing bounds check, enabling local privilege escalation to System level. Exploitation is described as locally achievable without user interaction. Reported impact tiers include confidentiality, integrity, and availab...

CVE-2023-20774

CVE-2023-20774 involves an out-of-bounds read in the display path due to a missing bounds check, enabling local privilege escalation with System execution privileges required and no user interaction. Multiple connected sources (MediaTek-related advisories and vendor feeds) confirm the issue affec...

CVE-2023-21232

CVE-2023-21232 corresponds to a permissions-bypass information-disclosure issue affecting Wear OS and related Android components. The vulnerability allows retrieval of sensor data without permission, with local access and no user interaction required. Exploitation details (vector, affected versio...

CVE-2023-30927

Summary : CVE-2023-30927 is a local information disclosure vulnerability due to a missing permission check in the telephony service. The NVD entry reports a CVSSv3.1 base score of 5.5 (LOW privileges required, LOCAL exploit, HIGH confidentiality impact). Connected sources corroborate the issue an...

CVE-2023-30931

CVE-2023-30931 involves a missing permission check in the telephony service that could allow local information disclosure without additional execution privileges. The issue is described across multiple sources as affecting UNISOC chipsets (telephony component), with attack vector LOCAL, attack co...

CVE-2023-30933

CVE-2023-30933 involves a missing permission check in the telephony service that enables local information disclosure without additional execution privileges. The core issue is the telephony component failing to enforce access controls, per the CVE description. Connected documents expand on affec...

CVE-2023-30934

The CVE-2023-30934 entry describes a local information disclosure in the telephony service due to a missing permission check. Affected scope is supported by connected records noting UNISOC chipset impacts (e.g., various SC-series and T-series devices) with exploitation possible without additional...

CVE-2023-33900

CVE-2023-33900 : In the telephony service, a missing permission check allows local information disclosure without extra privileges (CVSS 3.1: Local access, High confidentiality impact, Medium overall). Affected scope is described as the telephony component; some connected sources reference UNISOC...

CVE-2023-33902

CVE-2023-33902 affects UNISOC Bluetooth service across multiple chipsets (e.g., SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T618/T612/T616/T770/T820/S8000). The root cause is a missing permission check in the Bluetooth service, enabling local information disclosure without additional execution pr...

CVE-2023-38442

CVE-2023-38442 affects vowifiservice. The issue is a missing permission check that could lead to local information disclosure with no additional execution privileges. CVSS v3.1 base score 5.5 (Medium) with LOCAL attack vector, low attack complexity, low privileges required, and high confidentiali...

CVE-2023-42673

CVE-2023-42673 concerns the imsservice component, where a missing permission check enables an app to potentially write permission usage records, causing local information disclosure with no extra execution privileges. The vulnerability is described across multiple feeds (NVD/Red Hat/CVE records) ...

CVE-2023-42681

CVE-2023-42681 affects the ion service in Unisoc chipsets, where a missing permission check can allow local escalation of privilege without requiring additional execution privileges. The issue is rooted in the ion service’s access control, enabling a local attacker with low privileges to exploit ...

CVE-2023-42687

CVE-2023-42687 : The wifi service contains a missing permission check that could enable local escalation of privilege with no additional execution privileges required. The available data from the CVE entry indicates a local exploit path with a high impact (Confidentiality/Integrity/Availability H...

CVE-2023-42702

CVE-2023-42702 describes a missing permission check in the firewall service that allows an attacker with local access to write permission usage records for an app, causing local information disclosure with no additional execution privileges. Affected: firewall service in UNISOC chipsets. Impact: ...

CVE-2023-42706

CVE-2023-42706 affects the firewall service, where a missing permission check can allow an attacker to write permission usage records for an app, enabling local information disclosure without extra execution privileges. Root cause: inadequate authorization in the firewall service. Impact: confide...

CVE-2023-42711

The CVE-2023-42711 entry concerns a vulnerability in the firewall service where a missing permission check allows an app to write permission usage records, causing local information disclosure with no extra execution privileges required. Affected component: firewall service (general description a...

CVE-2023-42713

CVE-2023-42713 affects UNISOC chipsets’ firewall service, where a missing permission check enables an app to write permission usage records. Root cause: inadequate authorization on the firewall service, allowing local information disclosure without extra execution privileges. Impact: local inform...

CVE-2023-42721

The CVE-2023-42721 entry concerns the flv extractor component, where missing input validation is the reported root cause. This vulnerability could allow local denial of service without requiring user interaction or additional privileges, as described in multiple connected records (notably the Red...

CVE-2023-42723

CVE-2023-42723 concerns a vulnerability in camera services (Unisoc chipsets) caused by a missing bounds check leading to an out-of-bounds read. The NVD entry notes a local attack vector with low privileges required and no user interaction, resulting in local denial of service. Connected sources c...

CVE-2023-42732

Technical details about CVE-2023-42732 are not publicly available in the provided connected documents; monitor for updates from vendors and security advisories.

CVE-2023-42747

Consolidated details indicate a vulnerability in Unisoc chipsets where the camera service may lack a required permission check. This can enable local escalation of privilege without additional execution privileges. Affected component appears to be the camera service in Unisoc chipsets; no explici...

CVE-2025-20693

The CVE-2025-20693 issue affects the wlan STA driver, with an out-of-bounds read caused by an incorrect bounds check. This vulnerability could allow remote information disclosure from proximal access without extra privileges or user interaction. The impact is described as high confidentiality ris...

CVE-2025-20722

CVE-2025-20722 affects the gnss driver with an out-of-bounds read caused by an integer overflow. Exploitation would lead to local information disclosure if the attacker already has System privileges; no user interaction is required. A patch (ALPS09920036) is referenced (Issue MSV-3798).

CVE-2025-20785

CVE-2025-20785 affects MediaTek chipsets (display component). The issue is a memory corruption via a use-after-free in display paths, leading to local privilege escalation if an attacker already has System privileges. Exploitation details or in-the-wild status are not provided in the documents. A...

CVE-2025-48526

The CVE-2025-48526 affects ChooserActivity.java in Android’s Chooser component, where createMultiProfilePagerAdapter allows launching into another user profile due to improper input validation. The risk is local elevation of privilege with no required user interaction, and exploitation is local (...

CVE-2025-48546

CVE-2025-48546 affects SafeActivityOptions.java. The issue arises during checkPermissions, enabling a possible background activity launch due to a logic error. This can lead to local escalation of privilege with no additional execution privileges required, and no user interaction needed for explo...

CVE-2025-48548

CVE-2025-48548 describes a race condition in AppOpsControllerImpl.java that could allow recording audio without the privacy indicator, enabling local elevation of privilege with user interaction required. The issue is discussed across multiple sources (Android/Red Hat/CNVD views) with the same co...

CVE-2025-48630

CVE-2025-48630 describes an information-disclosure vulnerability in Skia’s drawLayersInternal (SkiaRenderEngine.cpp) that could grant a local attacker access to GPU cache data, enabling local escalation of privilege with no extra privileges or user interaction required. Public documents consisten...

CVE-2025-48631

CVE-2025-48631 affects Google Android (LocalImageResolver.java: onHeaderDecoded). The issue is a DoS caused by resource exhaustion, enabling remote denial of service with network access and no user interaction. Connected advisories confirm updates in Android and Samsung devices as fixes; patch le...

CVE-2026-0014

CVE-2026-0014 affects AppOpsService.java (method isPackageNullOrSystem) and describes a possible persistent denial of service due to improper input validation. The issue enables local DoS without user interaction or privileges, as indicated in multiple sources. Exploitation status and specific ex...

CVE-2026-0096

Technical details are not publicly available in the provided documents. Monitor for updates for potential affected products, impacted components, root cause, and remediation.