Summary
Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.
Product
Das Android Betriebssystem ist eine quelloffene Plattform für mobile Geräte. Die Basis bildet der Linux-Kernel.
Vulnerabilities 22
-
Critical 10.0
In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a l…
-
Critical 10.0
In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to loc…
-
Critical 10.0
In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed…
-
Critical 10.0
In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local…
-
Critical 10.0
In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escal…
-
Critical 10.0
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due t…
-
Critical 10.0
In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local …
-
Critical 10.0CVE-2026-0092 Public exploit
In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lea…
-
Critical 10.0
In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSessio…
-
Critical 10.0CVE-2026-28576 Public exploit
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to …
-
Critical 10.0
In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing pe…
-
Critical 10.0
In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lea…
-
High 8.0
In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. …
-
High 7.8
In setActualDefaultRingtoneUri of RingtoneManager.java, there is a possible way to bypass content providers read permis…
-
High 7.8CVE-2025-48617 Public exploit
In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass.…
-
High 7.8
In multiple locations there is a possible provisioning bypass due to improper input validation. This could lead to loca…
-
High 7.8
In SettingsLib, there is a possible way to disable system components due to a logic error in the code. This could lead …
-
High 7.5
Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to a…
-
High 7.5
Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire cre…
-
Medium 5.5
In multiple locations, there is a possible way to access media content belonging to another user due to a missing permi…
-
Medium 4.3
In multiple functions of btm_sec.cc, there is a possible way for an attacker to intercept SMS messages due to a logic e…
-
Low 3.3
In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to …
Revision history
-
#2
PoC CVE-2026-28576
-
#1
Initiale Fassung
References
-
Android Security Bulletin vom 2026-06-17
https://source.android.com/docs/security/bulletin/android-17
-
PoC CVE-2026-28576
https://www.mobilehackinglab.com/blog/cve-2026-28576-contacts-provider-sqli