Skip to content
OpenAdvisories

Vendor

Google

9,109 known vulnerabilities.

9,109 results · Feed

  • High 8.4
    CVE-2026-0047 Public exploit

    In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information du…

  • High 8.4

    In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the c…

  • High 8.4

    In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead…

  • High 8.4

    In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing fi…

  • High 8.4

    In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper…

  • High 7.8

    In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This …

  • High 8.4

    In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could …

  • High 8.4

    In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds c…

  • High 8.4

    In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to…

  • High 8.4

    In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This c…

  • Medium 6.7

    In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead t…

  • High 7.8

    In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due…

  • High 8.4

    In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypas…

  • Medium 4.0

    In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of …

  • High 7.8
    CVE-2026-0023 Public exploit

    In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership du…

  • High 8.4

    In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a …

  • High 8.4

    In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain per…

  • High 7.7

    In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the …

  • Medium 6.2

    In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input val…

  • Medium 6.2
    CVE-2026-0014 Public exploit

    In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input …

  • High 8.4
    CVE-2026-0013 Public exploit

    In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confus…

  • Medium 6.2

    In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error i…

  • High 8.4

    In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a lo…

  • High 8.4
    CVE-2026-0010 Public exploit

    In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This co…

  • High 8.4

    In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could l…

  • High 7.8

    In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjac…

  • Critical 9.8
    CVE-2026-0006 Public exploit

    In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead …

  • Medium 6.2

    In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing li…

  • High 7.8

    In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code.…

  • High 8.4

    In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in …

  • High 8.4

    In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escala…

  • High 7.8

    In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lea…

  • Critical 9.8

    In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. Th…

  • Medium 5.5

    In multiple locations, there is a possible persistent denial of service due to improper input validation. This could le…

  • Medium 5.5

    In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This cou…

  • High 7.0

    In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local es…

  • High 7.7

    In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic e…

  • High 8.4

    In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. T…

  • High 7.4

    In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel info…

  • High 8.4

    In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate fil…