CVE-2020-0422

CVE-2020-0422: Android system/framework vulnerability in NotificationImportExportListener.java due to an unsafe PendingIntent enables local information disclosure of contacts data with no user interaction; the issue is listed under the 2020-10-01/10-05 patch levels in the Android security bulleti...

CVE-2021-0521

CVE-2021-0521 affects the Android PackageManagerService’s getAllPackages function, enabling local information disclosure of cross-user permissions due to a missing permission check. The impact is information disclosure with no additional execution privileges or user interaction required, i.e., a ...

CVE-2021-0582

CVE-2021-0582 is an information-disclosure vulnerability in the Android Wi‑Fi driver caused by a missing bounds check that enables a remote attacker in adjacent network range to read memory without executing code or requiring user interaction. Impact is confidentiality loss (high per CVSS‑3.1) wi...

CVE-2021-0685

CVE-2021-0685 affects Android 11. In ParsedIntentInfo.java, there is a parcel serialization/deserialization mismatch due to unsafe deserialization, enabling local elevation of privilege with no extra execution privileges required. Exploitation requires local access; user interaction is not needed...

CVE-2021-0692

CVE-2021-0692 affects Android (Android-9/10/11) via a flaw in FirstScreenBroadcast.java: sendBroadcastToInstaller can trigger an activity launch through an unsafe PendingIntent, enabling local elevation of privilege with no extra execution privileges required. The issue is described as requiring ...

CVE-2021-39657

CVE-2021-39657 concerns an out-of-bounds read in the Android kernel’s ufshcd_eh_device_reset_handler (ufshcd.c). The issue enables local information disclosure with System privileges required, and does not require user interaction to exploit. The provided connected documents reiterate the same de...

CVE-2021-39725

CVE-2021-39725 affects the Android kernel component gasket_page_table.c, specifically the function gasket_free_coherent_memory_all. The issue is memory corruption caused by a double free, enabling local escalation of privilege with System-level execution privileges required; exploitation is descr...

CVE-2021-39737

CVE-2021-39737 is listed in the Pixel security bulletin as a Modem component vulnerability (RCE) affecting Google Pixel devices. The entry ties the issue to the Pixel modem with a critical impact profile (CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The public documentation does not specify t...

CVE-2022-44429

Technical details about CVE-2022-44429 are not publicly provided in the supplied documents. No confirmed affected products, versions, or fixes are listed here. Monitor for official disclosures and vendor advisories.

CVE-2022-44434

CVE-2022-44434 affects a messaging service component and is caused by a missing permission check, enabling local denial of service in the contacts service with no extra privileges required. The vulnerability has a CVSS v3.1 base score of 5.5 (AV:L, AC:L, PR:L, UI:N, S:U, C:N, I:N, A:H), indicatin...

CVE-2022-44438

CVE-2022-44438 affects the Android messaging service (in Unisoc contexts) where a missing permission check can allow a local denial of service in the contacts service without extra privileges. Root cause: inadequate access control in the messaging component. Impact: local DoS as described in mult...

CVE-2022-47459

CVE-2022-47459 concerns a vulnerability in the WLAN driver where a missing parameter check can lead to a local denial of service in WLAN services. The concrete details across connected sources consistently identify the affected component as the WLAN driver and describe the root cause as an inadeq...

CVE-2023-21000

CVE-2023-21000 relates to a use-after-free in MediaCodec.cpp due to improper locking, enabling local privilege escalation on Android 13. The vulnerability affects the Android MediaCodec path and is described across multiple sources (NVD, Red Hat, PRION, PT-Security, and Pixel bulletin). The provi...

CVE-2023-21249

The vulnerability is in Google Android's Framework, specifically OneTimePermissionUserManager.java, where a permissions bypass can cause a one‑time permission to be retained. This could enable local elevation of privilege with User execution privileges required and no user interaction. Public tec...

CVE-2023-40080

CVE-2023-40080 involves the Bluetooth stack in Android (btm_ble_gap.cc) where a logic error can cause an out-of-bounds write, leading to local elevation of privilege without extra execution privileges or user interaction. The issue is categorized with high impact and is described across multiple ...

CVE-2023-40092

CVE-2023-40092 affects the Android Framework, specifically the verifyShortcutInfoPackage function in ShortcutService.java. The Red Hat/Android/NVD entries describe a confused deputy scenario that could allow an authenticated local attacker to view another user’s image, causing local information d...

CVE-2023-40130

CVE-2023-40130 affects Android’s CallRedirectionProcessor (notifyTimeout). The issue is a logic error allowing a local elevation of privilege with no extra execution privileges required and no user interaction. The documentation explicitly states the vulnerability as a permission bypass in the Ca...

CVE-2023-48421

CVE-2023-48421 affects Google Pixel GPU driver code: gpu_pixel_handle_buffer_liveness_update_ioctl in private/google-modules/gpu/mali_kbase/platform/pixel/pixel_gpu_slc.c. Root cause is an out-of-bounds write due to improper input validation, enabling local privilege escalation with no extra priv...

CVE-2023-48423

CVE-2023-48423 : The vulnerability is an out-of-bounds write in the function dhcp4_SetPDNAddress of dhcp4_Main.c caused by a missing bounds check. This could enable remote code execution with no additional privileges and without user interaction. Public documents (NVD, OSV) reiterate the same des...

CVE-2024-27205

A memory corruption vulnerability exists in the Bluetooth subcomponent of Google Pixel devices due to a use after free condition. This flaw could allow for local elevation of privilege (EoP) without requiring additional execution privileges or user interaction. Remediation is available in securit...

CVE-2018-9385

CVE-2018-9385 affects the Linux/Android kernel: in driver_override_store of bus.c there is an out-of-bounds write due to an incorrect bounds check, enabling local privilege escalation with SYSTEM privileges. Exploitation reportedly does not require user interaction. Connected advisories (Unity Li...

CVE-2020-0001

CVE-2020-0001 affects Android’s framework (ActivityManagerService.java, getProcessRecordLocked). The issue arises from improper handling of isolated apps, enabling local escalation of privilege without extra execution privileges. Impact is described as local elevation of privilege with high confi...

CVE-2020-0251

CVE-2020-0251 : An out-of-bounds read due to an incorrect bounds check in the Android Multimedia Processing Driver (Android SoC). Per the CVE entry, it is rated HIGH (CVSS v3.1 base 7.5). Connected documents corroborate the component as the Multimedia Processing Driver in Android; no exploitation...

CVE-2020-0252

CVE-2020-0252 is a memory-corruption (use-after-free) issue affecting the MediaTek Multimedia Processing Driver in Google Android. The Red Hat/Red Hat-derived and CVE catalogs classify it as an Elevation of Privilege (High) vulnerability. The Android security bulletin for 2020-08-01/08-05 lists M...

CVE-2020-0397

The CVE-2020-0397 entry describes a permission bypass in Android’s CarrierServiceStateTracker.getNotificationBuilder due to an unsafe PendingIntent, enabling local information disclosure with low attack complexity. Affected are Android 8.0–11 variants (Android-8.0, 8.1, 9, 10, 11) per the officia...

CVE-2020-0401

CVE-2020-0401 involves a missing permission check in setInstallerPackageName within PackageManagerService.java, enabling local escalation of privilege and granting spurious permissions without extra execution privileges. Affected: Android 8.0–11. Impact per sources: local privilege escalation wit...

CVE-2020-0421

CVE-2020-0421 is an Elevation of Privilege vulnerability in the Android Framework (affecting Android 8.0–11) that could allow a locally malicious app to bypass user interaction requirements and gain additional permissions. The root cause is described as an out-of-bounds write in String8.cpp (appe...

CVE-2021-0324

CVE-2021-0324 is associated with Android/Unisoc components in the 2021 May Android bulletin. Sources catalog it under Unisoc Framework with High severity (per patch-level details), affecting Android devices via the Android SoC/Unisoc stack. The connected records do not provide concrete technical ...

CVE-2021-0330

CVE-2021-0330 is an Android vulnerability affecting storaged.cpp in the Android framework, where an improper locking leads to a possible use-after-free in add_user_ce and remove_user_ce. This could enable local escalation of privilege in storaged without additional execution privileges or user in...

CVE-2021-0391

CVE-2021-0391 affects Android Open Source Project: the vulnerability resides in the UI flow of ChooseTypeAndAccountActivity (onCreate in ChooseTypeAndAccountActivity.java). It allows learning whether an account exists via a tapjacking/overlay attack, without requiring permissions. Impact: local e...

CVE-2021-0392

CVE-2021-0392 is documented with concrete details in the connected data: Android platform (versions Android-9, Android-10, Android-11) is affected by a memory corruption due to a double free in main.cpp. This vulnerability is categorized as an Elevation of Privilege (local) with the potential to ...

CVE-2021-0466

CVE-2021-0466 is an Android 10 information-disclosure vulnerability. It resides in startIpClient of ClientModeImpl.java and could expose a device identifier to a proximal attacker without remote code execution or user interaction. The Red Hat and NVD entries confirm the issue affects Android 10 a...

CVE-2021-0601

CVE-2021-0601 : Android Media Framework vulnerability in encodeFrames of avc_enc_fuzzer.cpp enables a possible out-of-bounds write due to a double free, leading to local information disclosure with no special privileges required. Exploitation requires no user interaction. Affected products/versio...

CVE-2021-0687

Technical details about CVE-2021-0687 are not provided in the connected documents. The available description notes an Android ANR/DoS scenario arising from input validation in Layout.java; no product/version specifics or remediation are included here. Monitor for updates.

CVE-2021-0952

CVE-2021-0952 affects Android devices (Android 9–12) and stems from a vulnerability in doCropPhoto within PhotoSelectionHandler.java that enables a possible permission bypass via a confused deputy. This could allow local information disclosure of a user’s contacts with no additional execution pri...

CVE-2021-39716

CVE-2021-39716 is present in multiple feeds. The Pixel Update Bulletin categorizes it under Modem with type ID and Moderate severity, indicating a Modem-related issue in Pixel devices; remediation is via Google’s 2022-03-05 patch level. However, the NVD entry lists the affected component as Andro...

CVE-2021-39727

CVE-2021-39727 describes an information-disclosure vulnerability in Android’s acropora/app/identity/libeic/EicPresentation.c, caused by a race condition in the function eicPresentationRetrieveEntryValue . The issue can enable local information disclosure with System-level privileges and does not ...

CVE-2021-39732

CVE-2021-39732 affects the Android kernel component copy_io_entries in lwis_ioctl.c. It describes an out-of-bounds write caused by an integer overflow, which could enable local privilege escalation without user interaction. The available connected documents confirm the issue’s presence in Android...

CVE-2021-39736

CVE-2021-39736 affects the Android kernel: in lwis_ioctl.c and lwis_periodic_io.c, an integer overflow can cause an out-of-bounds write, enabling local elevation of privileges with SYSTEM access. Exploitation details are not provided in the documents, and no user interaction is required for explo...

CVE-2022-20006

CVE-2022-20006 affects Android 10–12 (including 12L). A race condition in KeyguardServiceWrapper.java and related files can briefly reveal what’s under the lock screen, enabling local privilege escalation if a Guest user is enabled. Exploitation does not require user interaction. The issue is lis...

CVE-2022-20105

CVE-2022-20105 concerns MediaTek MM service vulnerable to a stack-based buffer overflow causing an out-of-bounds write, enabling local privilege escalation with SYSTEM-level execution privileges required by the exploit. All sources consistently describe the flaw as a local, no-user-interaction vu...

CVE-2022-20236

CVE-2022-20236 is referenced in the Android Security Bulletin under Unisoc GPU; the affected component is a UNISOC GPU driver. The underlying root cause and specific impact are not detailed in the provided documents. The CVSS from NVD indicates HIGH impact with network attack vector and no user i...

CVE-2022-20390

Technical details about CVE-2022-20390 are not publicly available in the provided documents. Monitor the Android Bulletin and vendor advisories for updates and fixes.

CVE-2022-32594

CVE-2022-32594 concerns the Widevine component with an out-of-bounds write caused by an incorrect bounds check. Reported impact is local escalation of privileges requiring System execution privileges, with no user interaction needed. Connected sources confirm a patch exists (ALPS07446207/ALPS0744...

CVE-2022-32619

The CVE-2022-32619 issue is an out-of-bounds write in MediaTek’s keyinstall component caused by an incorrect bounds check, enabling local escalation of privilege with System-level privileges required; exploitation reportedly does not require user interaction. The vulnerability is identified in Me...

CVE-2022-42754

CVE-2022-42754 affects the npu driver, where a use-after-free leads to memory corruption that could cause local denial of service in the kernel. The available documents consistently describe a local-privilege-agnostic, local-execution scenario due to memory-management flaw in the npu component. N...

CVE-2023-20699

CVE-2023-20699 describes an out-of-bounds write in the MediaTek adsp module (affecting MediaTek-based devices) caused by a missing bounds check. Impact per sources: local escalation of privilege with System execution privileges required, no user interaction needed. Patch reference: ALPS07696073 (...

CVE-2023-21035

The connected Nessus entry (UNPATCHED_CVE_2023_21035.NASL) provides concrete technical details: CVE-2023-21035 affects Android 13 and is linked to BackupHelper.java, where a permissions-bypass could allow an app to access permissions previously granted to another app sharing the same package name...

CVE-2023-21279

CVE-2023-21279 concerns Android’s RemoteViews.visitUris, where a confused deputy could enable cross-user media reads and local information disclosure without extra execution privileges. The vulnerability is discussed across multiple sources tied to the Android security ecosystem (NVD, Red Hat, PR...

CVE-2023-35668

The CVE-2023-35668 entry affects Android’s Notification.java visitUris path, where a confused deputy could cause an image display from another user. This is an information-disclosure vulnerability with local impact and no execution privileges required (no user interaction). Connected sources corr...