Summary
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um beliebigen Programmcode auszuführen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 111
-
High 8.4
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to…
KEV Jun 2, 2026 -
High 8.8
Integer Overflow or Wraparound in GPS
Memory corruption when decoding corrupted satellite data files with invalid signature offsets.
-
High 8.8
Improper Validation of Array Index in Secure Processor
Memory corruption while using Strongbox due to missing bounds check.
-
High 8.8
Buffer Copy Without Checking Size of Input in Secure Processor
Memory corruption while using Strongbox due to buffer overflow.
-
High 8.4
In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in th…
-
High 8.0
In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overf…
-
High 8.0
In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged…
-
High 8.0
In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic erro…
-
High 8.0
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 8.0
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o…
-
High 7.8
In multiple locations, there is a possible way to reveal images across users due to improper input validation. This cou…
-
High 7.8
In resolveContentProvider of ComputerEngine.java, there is a possible way to access URIs across users due to a logic er…
-
High 7.8
In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when…
-
High 7.8
In multiple locations, there is a possible background activity launch due to a missing permission check. This could lea…
-
High 7.8
af_unix: Initialise scc_index in unix_add_edge().
In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC could garbage-collect a receive queue of an alive in-flight socket, with a nice repro. The repro consis…
-
High 7.8
In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due t…
-
High 7.8
In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's defa…
-
High 7.8
In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaus…
-
High 7.8
In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypas…
-
High 7.8
In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error i…
-
High 7.8
NULL Pointer Dereference in SPS Applications
Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer.
-
High 7.8
Out-of-bounds Write in HLOS
Memory Corruption when processing device identifier strings that exceed the expected maximum length.
-
High 7.8
NULL Pointer Dereference in HLOS
Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization.
-
High 7.8CVE-2026-0009 Public exploit
In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escala…
-
High 7.8
In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. Th…
-
High 7.8
In bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure connection due to a logic…
-
High 7.8CVE-2026-0075 Public exploit
In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead …
-
High 7.8
In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. This cou…
-
High 7.8
In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a…
-
High 7.8
In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input v…
-
High 7.8
In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app…
-
High 7.8
In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misle…
-
High 7.8
In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a miss…
-
High 7.8CVE-2026-0091 Public exploit
In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell …
-
High 7.8
In multiple locations, there is a possible misleading UI due to obfuscation. This could lead to local escalation of pri…
-
High 7.8
In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to cer…
-
High 7.8
In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to m…
-
High 7.8
In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confuse…
-
High 7.8
In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to…
-
High 7.8
In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to lo…
-
High 7.8
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
High 7.8
DNG SDK | Out-of-bounds Write (CWE-787)
DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a ma…
-
High 7.8
DNG SDK | Integer Overflow or Wraparound (CWE-190)
DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim mus…
-
High 7.8
Heap-Based Buffer Overflow in Power Management IC
Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.
-
High 7.8
Buffer Over-read in Camera
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
-
High 7.8
Buffer Over-read in Camera
Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.
-
High 7.8
Buffer Over-read in Camera
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.
-
High 7.8
Buffer Over-read in Camera
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
-
High 7.8
Buffer Over-read in Camera
Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.
-
High 7.8
Use After Free in DSP Service
Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.
-
High 7.8
GPU DDK - Unsafe writing of MMU PT entries on systems with 32-bit host CPU
Requires malware code to misuse the DDK kernel module IOCTL interface. Such code can use the interface in an unsupported way that allows subversion of the GPU to perform writes to arbitrary physical memory pages. The product utilises a shared resource in a co…
-
High 7.8
GPU DDK - Cache resident PM buffers writable by other GPU requestors, leading to arbitrary write to physical memory
Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbitrary physical memory pages. Under certain circumstances this exploit could be used to corrupt data pages not allocated by the GPU driver bu…
-
High 7.8
In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. Thi…
-
High 7.8
In multiple functions of NotificationChannel.java, there is a possible desync in persistence due to an incorrect bounds…
-
High 7.6
Buffer Over-read in WLAN Firmware
Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.
-
High 7.6
Buffer Over-read in WLAN Firmware
Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.
-
High 7.5
In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service …
-
High 7.5
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additi…
-
High 7.5
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additi…
-
High 7.5
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additi…
-
High 7.5
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additi…
-
High 7.5
In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additio…
-
High 7.2
Stack-based Buffer Overflow in Display
Memory Corruption when processing display command line information due to improper initialization of a variable.
-
High 7.2
Improper Validation of Syntactic Correctness of Input in Kernel
Memory corruption while processing fastboot commands with invalid input.
-
High 7.1
Buffer Over-read in Computer Vision
Cryptographic issue while copying data to a destination buffer without validating its size.
-
High 7.1CVE-2025-64720 Public exploit
LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, an out-of-bounds read vulnerability exists in png_image_read_composite when proces…
-
High 7.1CVE-2025-65018 Public exploit
LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read`
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. From version 1.6.0 to before 1.6.51, there is a heap buffer overflow vulnerability in the libpng simplified API functio…
-
Medium 6.8
In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/o…
-
Medium 6.8
In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null …
-
Medium 6.7
In geniezone, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escal…
-
Medium 6.7
In geniezone, there is a possible escalation of privilege due to a missing permission check. This could lead to local e…
-
Medium 6.7
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio…
-
Medium 6.5
Reachable Assertion in FW
Transient DOS when MAC configures config id greater than supported maximum value.
-
Medium 6.5
Buffer Over-read in WLAN HAL
Transient DOS when processing target power rate tables during channel configuration.
-
Medium 6.5
Buffer Over-read in WLAN Firmware
Transient DOS when processing a malformed Fast Transition response frame with an invalid header structure during wireless roaming.
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause the system to crash due to an int…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper in…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 6.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo…
-
Medium 6.5
In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE h…
-
Medium 6.5
In Modem, there is a possible system crash due to a heap buffer overflow. This could lead to remote denial of service, …
-
Medium 6.5
In Modem, there is a possible system crash due to incorrect error handling. This could lead to remote denial of service…
-
Medium 6.4
In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of p…
-
Medium 6.2
In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tap…
-
Medium 6.2
In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC…
-
Medium 6.1
LIBPNG is vulnerable to a heap buffer overflow in `png_do_quantize` via malformed palette index
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files. Prior to version 1.6.51, a heap buffer over-read vulnerability exists in libpng's png_do_quantize function when process…
-
Medium 5.9
In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a…
-
Medium 5.5
In multiple files, there is a possible way to reveal information across users due to a missing permission check. This c…
-
Medium 5.5
In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. This co…
-
Medium 5.5
In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to impr…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to resource e…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer…
-
Medium 5.5
In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, there is a possible persistent dos issue due …
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a permanent denial of service due…
-
Medium 5.5
In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This coul…
-
Medium 5.5
In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due…
-
Medium 5.5
In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service due to resource exhaustio…
-
Medium 5.5
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer…
-
Medium 5.5
In applySimpleFieldMaxSize of DataRowHandler.java, there is a possible way to insert a large contact name due to improp…
-
Medium 5.5
In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper i…
-
Medium 4.6
In preloader, there is a possible read of device unique identifiers due to a logic error. This could lead to local info…
-
Medium 4.4
GPU DDK - Insufficient permission check in PhysmemWrapExtMem() when write attribute support enabled
Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory. This is caused by improper handling of the memory protections for the user-mode wrapped memory resource.
-
Medium 4.0
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a…
-
Low 3.3
In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinnin…
-
Low 3.3
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings acr…
-
Low 3.3
In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permiss…
-
Low 3.3
In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead…
-
Low 3.3
In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. …
Revision history
-
#1
Initiale Fassung
References
-
Android Patchday Juni 2026 vom 2026-06-01
https://source.android.com/docs/security/bulletin/2026/2026-06-01