CVE-2020-0416

CVE-2020-0416 affects the Android System component across Android 8.0–11. The issue is an elevation-of-privilege via tapjacking in multiple settings screens caused by an insecure default value, requiring user interaction to exploit and enabling local escalation of privileges and permissions. Docu...

CVE-2021-0306

CVE-2021-0306 describes a vulnerability in Android’s PermissionManagerService.addAllPermissions that enables a local elevation of privilege by bypassing permission checks to obtain the android.permission.ACTIVITY_RECOGNITION without user confirmation. Affected products include Android versions 8....

CVE-2021-0322

CVE-2021-0322 affects Android, specifically SlicePermissionActivity.java. In onCreate, an input-validation issue could cause a misleading string to be displayed, potentially enabling local information disclosure. The vulnerability requires user interaction for exploitation and affects Android 9–1...

CVE-2021-0397

CVE-2021-0397 : A double-free in Android’s sdp_copy_raw_data (sdp_discovery.cc) can cause remote code execution with no privileges and no user interaction. Affected: Android 8.1, 9, 10, 11 (per public advisories). Root cause: memory management flaw (double free) in SDP discovery path. Impact: rem...

CVE-2021-0931

CVE-2021-0931 – Android BluetoothDevice.getAlias information disclosure . The issue is reported in BluetoothDevice.java: missing data filtering can cause misleading permission dialogs, enabling local information disclosure with user interaction required. Affected products/versions include Android...

CVE-2021-0935

The CVE-2021-0935 entry concerns the Linux kernel IPv6 path: in ip6_xmit() within ip6_output.c, an out-of-bounds write can occur due to a use-after-free, enabling locally escalated privileges with SYSTEM/root rights. Exploitation details are not provided in the supplied documents. Some connected ...

CVE-2021-39715

The CVE refers to an information disclosure in the Android kernel: in __show_regs of process.c, log information disclosure could leak kernel memory/addresses, enabling local information leakage with SYSTEM privileges. Affected software: Android kernel components; vulnerable item: the show_regs pa...

CVE-2022-20394

CVE-2022-20394 affects Android 10–12/12L with a missing permission check in InputMethodManagerService.getInputMethodWindowVisibleHeight, allowing an app to determine when another app’s IME is shown and potentially disclose information locally. Exploitation requires user interaction; no remote cod...

CVE-2022-20413

The CVE-2022-20413 issue is in Android’s media handling logic, specifically at the start of Threads.cpp, enabling an attacker to record audio during a phone call. The flaw can cause local information disclosure with User privileges and does not require user interaction, with exploitation describe...

CVE-2022-20486

CVE-2022-20486 affects Android (Android-10, -11, -12, -12L, -13) where NotificationChannel.java may fail to persist permissions due to resource exhaustion, enabling local elevation of privilege with no extra execution privileges required. The issue is described as a resource-exhaustion vulnerabil...

CVE-2022-20492

CVE-2022-20492 concerns Android where, in several functions of AutomaticZenRule.java , there is a potential failure to persist permissions settings due to resource exhaustion. This can lead to local elevation of privilege with no additional execution privileges required. Exploitation details are ...

CVE-2022-20493

CVE-2022-20493 affects Android 10–13 (Android-10 to Android-13) via Condition.java, where improper input validation could grant notification access and cause local elevation of privilege. Exploitation requires user interaction; no additional execution privileges are needed. Patch references point...

CVE-2023-20952

The CVE-2023-20952 issue is in the A2DP_BuildCodecHeaderSbc function of a2dp_sbc.cc, where a missing bounds check allows an out-of-bounds write. This can cause local information disclosure without requiring exploits or user interaction. Affected products/versions are Android 11, 12, 12L, and 13; ...

CVE-2023-20953

CVE-2023-20953 affects Android 13, targeting ClipboardListener.java via onPrimaryClipChanged. The issue may bypass factory‑reset protection, enabling local elevation of privilege with no extra execution privileges; exploitation requires user interaction. No public patch/version details are provid...

CVE-2023-21139

CVE-2023-21139 is tied to Android 13 in the SysUI component, where the unsafe Intent in the MediaControlPanel.java function bindPlayer can launch a privileged activity. This creates a local elevation-of-privilege risk with no extra execution privileges and no user interaction required for exploit...

CVE-2023-21266

CVE-2023-21266 affects Android’s ActivityManagerService.java, describing a permissions bypass that could enable local escalation of privilege with no additional execution privileges required. Exploitation is stated to require no user interaction. The connected documents consistently frame this as...

CVE-2023-40133

CVE-2023-40133: In multiple locations of DialogFillUi.java, a confused deputy vulnerability allows an attacker to perform local information disclosure by viewing another user’s images. This requires no user interaction and can be exploited with local privileges (low attack complexity, low privile...

CVE-2024-0053

The CVE-2024-0053 issue affects the Android framework in PrintManagerService.getCustomPrinterIcon, where a proxy/confused-deputy mechanism could enable local information disclosure by viewing other users’ images. The underlying cause is information disclosure via getCustomPrinterIcon, with exploi...

CVE-2024-40674

CVE-2024-40674 affects Google Android via WifiConfigurationUtil.java (validateSsid). The issue is a logic error that could overflow a system configuration file, causing a local denial of service without requiring privileges or user interaction. Public details consistently reference Android/WifiCo...

CVE-2020-0075

CVE-2020-0075 affects the FPC Iris TZ App within Android (FPC component). Description: out-of-bounds read due to a missing bounds check in set_shared_key, enabling local information disclosure with System privileges required; no user interaction needed. Mode: Normal (concrete details provided). C...

CVE-2021-0506

CVE-2021-0506 corresponds to a tapjacking/overlay bypass in ActivityPicker.java that can bypass required user interaction during intent resolution, enabling local elevation of privilege with User execution privileges needed. Affected products/versions include Android 8.1, 9, 10, and 11. The vulne...

CVE-2021-0593

Technical details about CVE-2021-0593 are not publicly provided in the connected documents. Available references confirm the issue and affected Android versions, but no specific exploit vectors, affected builds, or mitigations are included here. Monitor for updates.

CVE-2021-0642

CVE-2021-0642 affects Android where, in VoicemailSettingsFragment.onResume, an attacker could retrieve a trackable identifier without required permissions due to a missing permission check, leading to local information disclosure. Exploitation requires user interaction; no privileges or remote ac...

CVE-2022-20081

CVE-2022-20081 affects the A-GPS component and is caused by improper certificate validation, enabling a remote attacker to perform a man-in-the-middle attack that could disclose information without user interaction. Multiple connected sources (RH, CNVD, NVD/NVD list, and related security bulletin...

CVE-2022-20393

CVE-2022-20393 = Integer overflow in extract3GPPGlobalDescriptions (TextDescriptions.cpp) can trigger an out-of-bounds read, leading to local information disclosure from the media server. Affected: Android 11, Android 12, Android 12L. Root cause and impact are stated in multiple trusted sources; ...

CVE-2022-20447

CVE-2022-20447 affects Android 13 and is tied to the PAN_WriteBuf function in pan_api.cc, where a use-after-free can cause an out-of-bounds read. This leads to remote information disclosure over Bluetooth without user interaction. Public details in the provided documents identify the vulnerable c...

CVE-2022-20476

CVE-2022-20476 describes a vulnerability in Android where, in PackageManager.setEnabledSetting, a path could cause the device to enter an infinite reboot loop due to resource exhaustion. This leads to local denial of service with no additional privileges required. Affected are Android 10, 11, 12,...

CVE-2023-20936

CVE-2023-20936 affecting Android 11–13: In bta_av_rc_disc_done of bta_av_act.cc, an out-of-bounds write is caused by a missing bounds check, enabling local elevation of privilege with no extra user interaction beyond local access. Multiple sources (NVD, CVE records, and Android security bulletins...

CVE-2023-21057

CVE-2023-21057 affects the Android kernel component RohcPacketCommon, specifically the function path in ProfSixDecomTcpSACKoption. The issue is an out-of-bounds write caused by a missing bounds check, which could allow remote code execution without any privileges or user interaction. The vulnerab...

CVE-2023-21093

CVE-2023-21093 concerns a path traversal in Android’s FileUtils.extractRelativePath that can let an attacker access files in directories belonging to other apps, enabling local elevation of privilege with no extra execution privileges and no user interaction. The vulnerability affects Android 11–...

CVE-2023-21112

CVE-2023-21112 relates to a missing bounds check in AnalyzeMfcResp of NxpMfcReader.cc, causing a possible out-of-bounds read that could disclose local information. Affected software includes Android 11–13 (Android devices relying on this component). The vulnerability enables information disclosur...

CVE-2023-21128

The CVE-2023-21128 entry covers a local elevation of privilege in Android’s AppStandbyController.java caused by a logic error in multiple functions. Affected products/versions include Android 11, 12, 12L, and 13; the issue enables privilege escalation with LOW privileges required and no user inte...

CVE-2023-21136

CVE-2023-21136 affects Android (Android-11 to Android-13) with a vulnerability in JobStore.java. The issue arises from improper input validation in multiple functions, which can cause a crash on startup and lead to local denial of service without requiring additional privileges. The connected Nes...

CVE-2023-35680

Technical details about CVE-2023-35680 are not publicly disclosed in the provided documents. Monitor for updates from the cited sources (Android security bulletin, NVD/CVE entries) for affected components, versions, and fixes.

CVE-2019-2054

CVE-2019-2054 involves a seccomp bypass in the Android/Linux kernel prior to 4.8, where seccomp policies allow ptrace usage. This could enable local privilege escalation without additional execution privileges and without user interaction. The core issue is that certain seccomp policies permit pt...

CVE-2021-0645

CVE-2021-0645 is an elevation-of-privilege issue in Android 11 involving shouldBlockFromTree in ExternalStorageProvider.java. The root cause is a permissions bypass that could let a local attacker read private app directories in external storage, with exploitation reportedly requiring user intera...

CVE-2021-0924

CVE-2021-0924 affects the Android kernel USB stack, specifically the xhci driver. In xhci_vendor_get_ops of xhci.c, a missing bounds check enables an out-of-bounds read. This could allow local escalation of privilege with no additional execution privileges required and without user interaction. P...

CVE-2021-39618

CVE-2021-39618 affects Android 9–12 where the EuiccNotificationManager.java contains an unsafe PendingIntent that allows a local attacker to install existing packages without user consent. This enables local privilege escalation with user privileges required, and exploitation does not require use...

CVE-2021-39626

CVE-2021-39626 affects Android devices (Android-9 to Android-12) via a permission bypass in ConnectedDeviceDashboardFragment.java (onAttach), enabling local privilege escalation in Bluetooth settings with no extra execution privileges or user interaction required. The NVD entry notes a high base ...

CVE-2022-20221

CVE-2022-20221 affects Android devices with a vulnerability in avrc_ctrl_pars_vendor_cmd (avrc_pars_ct.cc) where improper input validation can cause an out-of-bounds read, enabling remote information disclosure over Bluetooth without extra privileges. The issue resides in the Bluetooth AVRCP pars...

CVE-2022-20502

CVE-2022-20502 affects Android 13 where GetResolvedMethod in entrypoint_utils-inl.h can experience a use-after-free from a stale cache, causing local information disclosure without user interaction. The Android Security Bulletin lists this issue under Android Runtime with local information disclo...

CVE-2022-21767

CVE-2022-21767 affects MediaTek Bluetooth on multiple chips. Root cause: out-of-bounds write due to missing boundary checks in Bluetooth, enabling local escalation of privilege with no user interaction. Patch ALPS06784430/ALPS06784430 issued; Android/Mart evidence references list Bluetooth as aff...

CVE-2023-21082

The CVE-2023-21082 entry describes an information-disclosure flaw in Android related to getNumberFromCallIntent in NewOutgoingCallIntentBroadcaster.java. Affected: Android 11–13 (Android-11, Android-12, Android-12L, Android-13). Root cause: a confused deputy allows enumerating other users’ contac...

CVE-2023-21131

CVE-2023-21131 concerns a logic error in ActivityManagerService.checkKeyIntentParceledCorrectly() that can bypass Parcel Mismatch mitigations, enabling local escalation of privilege to launch arbitrary activities in settings without extra privileges. Affected: Android 11–13 (Android-11, Android-1...

CVE-2023-21133

CVE-2023-21133 affects Android’s ManagePermissionsActivity.java. The onCreate path contains a missing permission check, which could bypass factory reset protections and enable local elevation of privilege with physical access and no extra execution privileges required. Exploitation details are no...

CVE-2024-0045

CVE-2024-0045: A vulnerability exists in the smp_proc_sec_req function of smp_act.cc that can trigger an out-of-bounds read due to improper input validation. This may allow remote information disclosure without additional execution privileges and without user interaction. Multiple sources (Androi...

CVE-2024-23707

CVE-2024-23707 is an Android elevation-of-privilege issue caused by improper input validation in multiple locations, enabling a local bypass with no additional execution privileges but requiring user interaction. Public references show the flaw as fixed in Android’s 2024-05 patch cycle, with the ...

CVE-2017-13230

CVE-2017-13230 affects the Android Media framework, specifically an out-of-bounds write in the HEVC (H.265) codec caused by an incorrect bounds check on i2_pic_width_in_luma_samples. This can enable remote escalation of privilege with no additional execution privileges required, though exploitati...

CVE-2018-9383

CVE-2018-9383 is a vulnerability in the Linux kernel where the asn1_ber_decoder in lib/asn1_decoder.c allows an out-of-bounds read due to a missing bounds check. This can lead to local information disclosure and, per the description, system execution privileges could be required for exploitation;...

CVE-2019-2009

CVE-2019-2009 affects Android’s Bluetooth stack, specifically l2c_lcc_proc_pdu in l2c_fcr.cc. The issue is an out-of-bounds write due to a missing bounds check, enabling remote code execution over Bluetooth with no user interaction. Affected products/versions include Android 7.0 through 9 (Androi...