2,760 results · Feed
-
High 8.4
In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could l…
-
High 7.8
In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjac…
-
Critical 9.8CVE-2026-0006 Public exploit
In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead …
-
Medium 6.2
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing li…
-
High 7.8
In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code.…
-
High 8.4
In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in …
-
High 8.4
In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escala…
-
High 7.8
In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lea…
-
Critical 9.8
In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. Th…
-
Medium 5.5
In multiple locations, there is a possible persistent denial of service due to improper input validation. This could le…
-
Medium 5.5
In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This cou…
-
High 7.0
In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local es…
-
High 7.7
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic e…
-
High 8.4
In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. T…
-
High 7.4
In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel info…
-
High 8.4
In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate fil…
-
High 7.8
In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previo…
-
Critical 9.1
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, …
-
High 8.4
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the c…
-
High 8.4
In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypas…
-
Medium 6.2
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input …
-
Medium 6.2
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input …
-
High 8.4
In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an…
-
High 8.4
In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a conf…
-
High 7.8
In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission du…
-
High 7.4
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition. This…
-
High 8.4
In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events d…
-
High 7.4
In multiple locations, there is a possible lockscreen bypass due to a race condition. This could lead to local escalati…
-
High 7.8
In multiple locations, there is a possible bypass of a file path filter designed to prevent access to sensitive directo…
-
High 8.4
In UsageEvents of UsageEvents.java, there is a possible out of bounds write due to an incorrect bounds check. This coul…
-
Medium 6.5
In multiple functions of btm_ble_sec.cc, there is a possible unencrypted communication due to Invalid error handling. T…
-
Critical 9.3
In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check. This could lead to …
-
High 7.1CVE-2025-36911 Public exploit
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adja…
-
Medium 6.8
In U-Boot of append_uint32_le(), there is a possible fault injection due to a logic error in the code. This could lead …
-
Critical 9.8
In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect …
-
High 7.8
In GetTachyonCommand of tachyon_server_common.h, there is a possible out of bounds write due to an integer overflow. Th…
-
High 7.8
In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible memory corruption due to uninitialized data. This…
-
High 7.4
In bigo_worker_thread of private/google-modules/video/gchips/bigo.c, there is a possible use after free due to a race c…
-
High 7.8
In tracepoint_msg_handler of cpm/google/lib/tracepoint/tracepoint_ipc.c, there is a possible memory overwrite due to im…
-
High 7.8
In GetHostAddress of gxp_buffer.h, there is a possible out of bounds write due to a missing bounds check. This could le…