2,760 results · Feed
-
High 7.8
In bindAndGetCallIdentification of CallScreeningServiceHelper.java, there is a possible way to maintain a while-in-use …
-
Medium 5.5
In handleCreateConferenceComplete of ConnectionServiceWrapper.java, there is a possible way to reveal images across use…
-
High 7.8
In wifi_item_edit_content of styles.xml , there is a possible FRP bypass due to Missing check for FRP state. This could…
-
High 7.3
In onCreate of SettingsHomepageActivity.java, there is a possible way to access the Settings app while the device is pr…
-
High 7.8
In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalat…
-
High 8.4
In PVRSRVBridgeRGXKickTA3D2 of server_rgxta3d_bridge.c, there is a possible arbitrary code execution due to improper in…
-
High 7.4
In DevmemIntPFNotify of devicemem_server.c, there is a possible use-after-free due to a race condition. This could lead…
-
High 7.8
In sendDeviceState_1_6 of RadioExt.cpp, there is a possible use after free due to improper locking. This could lead to …
-
High 7.8
In setTransactionState of SurfaceFlinger.cpp, there is a possible way to perform tapjacking due to a logic error in the…
-
Medium 5.5
In shouldWrite of OwnersData.java, there is a possible edge case that prevents MDM policies from being persisted due to…
-
High 7.7CVE-2024-34740 Public exploit
In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection …
-
High 7.8CVE-2024-34741 Public exploit
In setForceHideNonSystemOverlayWindowIfNeeded of WindowState.java, there is a possible way for message content to be vi…
-
High 7.7
In ensureSetPipAspectRatioQuotaTracker of ActivityClientController.java, there is a possible way to generate unmovable …
-
High 7.8CVE-2024-34739 Public exploit
In shouldRestrictOverlayActivities of UsbProfileGroupSettingsManager.java, there is a possible escape from SUW due to a…
-
High 7.7
In multiple functions of AppOpsService.java, there is a possible way for unprivileged apps to read their own restrictRe…
-
Medium 6.2
In setupVideoEncoder of StagefrightRecorder.cpp, there is a possible asynchronous playback when B-frame support is enab…
-
High 7.7
In multiple functions of TranscodingResourcePolicy.cpp, there is a possible memory corruption due to a race condition. …
-
High 7.7
In onForegroundServiceButtonClicked of FooterActionsViewModel.kt, there is a possible way to disable the active VPN app…
-
High 7.5
In sdpu_compare_uuid_with_attr of sdp_utils.cc, there is a possible out of bounds read due to a heap buffer overflow. T…
-
High 7.8
In _MMU_AllocLevel of mmu_common.c, there is a possible arbitrary code execution due to an integer overflow. This could…
-
High 7.8
In PVRSRV_MMap of pvr_bridge_k.c, there is a possible arbitrary code execution due to a logic error in the code. This c…
-
High 7.4
In smp_proc_rand of smp_act.cc, there is a possible authentication bypass during legacy BLE pairing due to incorrect im…
-
Medium 5.3
In onTransact of ParcelableListBinder.java , there is a possible way to steal mAllowlistToken to launch an app from bac…
-
High 7.4
In DevmemIntUnexportCtx of devicemem_server.c, there is a possible arbitrary code execution due to a race condition. Th…
-
High 7.0
In _UnrefAndMaybeDestroy of pmr.c, there is a possible arbitrary code execution due to a race condition. This could lea…
-
Medium 6.2
In ensureFileColumns of MediaProvider.java, there is a possible disclosure of files owned by another user due to improp…
-
High 7.4
In com_android_internal_os_ZygoteCommandBuffer_nativeForkRepeatedly of com_android_internal_os_ZygoteCommandBuffer.cpp,…
-
High 7.4CVE-2024-31320 Public exploit
In setSkipPrompt of AssociationRequest.java , there is a possible way to establish a companion device association witho…
-
High 7.8
In multiple functions of StatsService.cpp, there is a possible memory corruption due to a use after free. This could le…
-
Medium 6.7
In DevmemIntFreeDefBackingPage of devicemem_server.c, there is a possible arbitrary code execution due to a logic error…
-
High 7.8
In setMimeGroup of PackageManagerService.java, there is a possible way to hide the service from Settings due to a logic…
-
High 8.4
In DevmemIntChangeSparse2 of devicemem_server.c, there is a possible arbitrary code execution due to a logic error in t…
-
High 8.4
In multiple locations, there is a possible way to bypass a restriction on adding new Wi-Fi connections due to a missing…
-
High 8.4
In updateNotificationChannelFromPrivilegedListener of NotificationManagerService.java, there is a possible cross-user d…
-
High 7.8
In hide of WindowState.java, there is a possible way to bypass tapjacking/overlay protection by launching the activity …
-
Medium 5.3
In multiple functions of MessageQueueBase.h, there is a possible out of bounds write due to a race condition. This coul…
-
High 7.8
In CompanionDeviceManagerService.java, there is a possible way to pair a companion device without user acceptance due t…
-
Medium 6.3
In updateServicesLocked of AccessibilityManagerService.java, there is a possible way for an app to be hidden from the S…
-
High 7.8
In onCreate of multiple files, there is a possible way to trick the user into granting health permissions due to tapjac…
-
High 7.8
In multiple locations, there is a possible way in which policy migration code will never be executed due to a logic err…