Android
Monthly
Denial of service in lottie-android 6.7.1 and earlier allows remote attackers to crash or hang applications by supplying a crafted Lottie animation JSON that contains a cyclic precomposition reference graph, which triggers uncontrolled recursion during layer model construction in BaseLayer.forModel and CompositionLayer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms unauthenticated, network-reachable availability impact with no confidentiality or integrity effect. No CISA KEV entry or public exploit code has been identified at time of analysis, but exploitation requires the host application to parse untrusted or remote Lottie files; applications rendering only bundled, trusted animations are not exposed.
SmsForwarder through 3.5.0 exposes an AndServer-based HTTP remote-control interface whose API endpoints are enabled by default and perform no authentication check, allowing anyone who can reach the device's listener on an adjacent network to read SMS messages, call logs and contacts, send SMS on the victim's behalf, and export or overwrite the app's configuration via the clone API. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) and the independent assessment agree that exploitation is unauthenticated and requires no user interaction, but is constrained to an adjacent network path such as the same LAN or Wi-Fi segment rather than arbitrary internet reachability. The vulnerability is not listed in CISA KEV and no public exploit code was identified at time of analysis; no EPSS score, no vendor CVSS 3.1 vector, and no explicit POC flag were provided, so those prioritization signals remain unknown rather than assumed.
Multiple Rakuten Mobile Android handsets - Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten Bigs - ship with AOSP default test keys still trusted by Android Verified Boot, so a system image signed with those publicly known keys passes boot integrity verification instead of being rejected. An attacker with physical possession of the handset and the ability to enter its flashing/fastboot mode can therefore install a crafted system image and gain full control of confidentiality, integrity, and availability (VC:H/VI:H/VA:H), which is the basis for the CVSS 4.0 base score of 7.0 (HIGH), gated heavily by the AV:P physical-access prerequisite. There is no public exploit code identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); the risk is concentrated in lost, stolen, seized, or resold devices rather than any remote or network-reachable attack path.
Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).
A stack-based buffer overflow in the Microsoft Graphics Component, reachable through Microsoft Office for Android, lets an authenticated attacker who can place a crafted document or graphics object in front of a victim gain code execution in the context of the mobile app, with high impact to confidentiality, integrity, and availability. Only builds from 16.0.1 up to but not including 16.0.20430.20000 are affected, and exploitation requires user interaction - the victim must open or render the malicious file - which materially narrows the practical attack surface despite the 8.0 CVSS score. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; the vendor has published an update-guide entry, so affected organizations should treat this as a credible mid-to-high priority patching item rather than a top-tier emergency.
An origin validation error (CWE-346) in Microsoft Power Apps allows an authenticated attacker to achieve remote code execution against affected client deployments by inducing a legitimate user to interact with attacker-controlled content. Only Microsoft Power Apps for Android before 3.26085.7 and Power Apps 1710 (9.2.23071.136) before 2608.5 are affected; patched builds are not vulnerable. Exploitation requires a valid authorized identity in the Power Apps environment (PR:L) plus victim interaction (UI:R), CISA's SSVC assessment records no observed exploitation and rates the attack as not automatable, and no public exploit identified at time of analysis; treat this as an elevated-priority but non-emergency patch item.
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Local code execution in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows an unprivileged local attacker to execute arbitrary code by supplying a crafted HEIF image on devices running firmware prior to SMR Oct-2026 Release 1. The flaw is an improper input validation issue in the 'sheifd' parsing path, rated 8.6 (CVSS 4.0) with high confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and the local attack vector requires the malicious file to be delivered from an on-device context.
Local code execution in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows unprivileged attackers to run arbitrary code by supplying a crafted HEIF cover image. This improper input validation flaw, tracked as CVE-2026-21124, affects Samsung devices prior to the SMR Oct-2026 Release 1 security update and carries a CVSS 4.0 score of 8.6, indicating high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and patched devices are not affected.
An out-of-bounds write in the native library libsamsungtts.so, part of the Samsung Text-to-Speech engine shipped on Samsung Android builds, allows code running locally on the device to corrupt memory and achieve arbitrary code execution in the TTS process context. The vulnerable component is reachable without special privileges or user interaction (CVSS 4.0 PR:N/UI:N), but the attack vector is local (AV:L), so the attacker must already have a malicious or compromised app or local process able to invoke the TTS engine and supply crafted input; there is no remote/network exploitation path. Samsung addresses the flaw in the SMR Oct-2026 Release 1 maintenance update, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Samsung's WSM service lets a malicious or compromised process already running on the device trigger a use-after-free and execute arbitrary code with system-level privileges. The flaw affects Samsung mobile firmware builds released before SMR Oct-2026 Release 1; remote network exploitation is not possible because the attacker must first have local code execution able to reach the WSM interface. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but the cross-boundary impact (scope change with high confidentiality, integrity and availability impact) makes prompt installation of the October 2026 security maintenance release the priority for any unpatched device.
Out-of-bounds write in Samsung's libsmkvextractor.so media-extraction library allows arbitrary code execution on Samsung mobile devices running firmware prior to SMR Oct-2026 Release 1. Exploitation requires local access - an attacker must already hold a foothold on the device or get a crafted MKV/Matroska media file into a local parsing path - yet the CVSS 4.0 vector requires no privileges and no user interaction (AV:L/PR:N/UI:N), and our independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) rates the impact as high integrity, low confidentiality, and low availability. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
OS command injection in CellHubs 'ExifTool for photo and video' 5.0.1-gms allows code execution within the app's own sandbox when a media file whose path or filename contains an embedded single quote and shell metacharacters is selected and exported to CSV. The app builds a shell string and passes it to /system/bin/sh -c, wrapping the media path in single quotes without escaping embedded single quotes, so the quoting can be broken out of and the remaining characters interpreted as shell commands. Exploitation is local and requires user interaction: the malicious file must already reside on the device and the victim must manually select it and trigger CSV export; the vulnerability received an assessed CVSS:3.1 score of 8.4 (equivalent 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Authentication requirements are unauthenticated per the CVSS vector (PR:N), meaning no prior privilege on the device is needed for an attacker who can plant the crafted file.
Information disclosure in the HPE Networking ClearPass Policy Manager Android client application allows an unauthenticated remote attacker to invoke improperly access-controlled application functionality from an untrusted source, potentially exposing sensitive information held on or accessible to the victim's mobile device. Exploitation requires the ClearPass Android client to be installed plus mandatory victim interaction (UI:R) with attacker-supplied content - for example a malicious co-installed app, crafted intent, deep link, or content - so delivery likely relies on an Android inter-component path rather than direct internet-facing exposure, and no public exploit was identified at time of analysis. Note that the vendor-supplied CVSS 3.1 vector (8.8, C:H/I:H/A:H) overstates the issue relative to the described confidentiality-only impact; our independent assessment limits the score to AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Information disclosure in Google Chrome for Android lets a remote attacker who successfully socially engineers a victim into opening a crafted HTML page expose sensitive data handled by the browser's Passwords component; builds prior to 155.0.8059.39 are affected, and no authentication or non-default configuration is required. The vendor classifies the issue as Low severity (CWE-200) and no public exploit code was identified at time of analysis. Note that the supplied CVSS base score of 8.8 (C:H/I:H/A:H) is inconsistent with the information-disclosure description and the vendor's Low rating; our independent assessment scores it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, i.e. a confidentiality leak that strictly depends on user interaction.
Google Chrome for Android prior to 155.0.8059.39 contains an incorrect-authorization flaw in its Transactions Platform component that lets an unauthenticated remote attacker read sensitive information from the browser by luring the victim into opening a crafted HTML page. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, though the attack is fully remote (AV:N/PR:N) and requires only that a user on a vulnerable Android build load the attacker's page (UI:R). Note that public severity signals conflict: the vendor rates this Chromium security severity 'Low' and limits impact to information disclosure, while a widely replicated CVSS 3.1 base score of 8.8 lists high integrity and availability impact that is not supported by the description - our independent assessment scores it 8.8-adjacent only on confidentiality (C:H/I:N/A:N).
Information disclosure in Google Chrome for Android (versions prior to 155.0.8059.39) allows remote, unauthenticated attackers to reach sensitive data held by the browser's Autofill feature via a crafted HTML page, with the flaw rooted in incorrect authorization (CWE-863) in the Autofill path. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), exploitation requires the victim to actively navigate to the attacker's page and the impact is confined to confidentiality, with no integrity or availability effect; the vendor-supplied 8.8 score (C:H/I:H/A:H) and the 'Low' Chromium severity conflict with this assessment and should be reconciled before prioritization. Chrome on Android is the affected build, no public exploit was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Origin policy bypass in Google Chrome for Android prior to 155.0.8059.39 lets a remote attacker acting through a confused deputy have actions carried out under a different web origin's authority, so a victim who is socially engineered into opening a crafted HTML page can have that page reach resources or capabilities it should never hold for its own origin. Only Chrome on Android is affected, exploitation is not silent (it requires the user to open attacker-supplied content, CVSS PR:N/UI:R), and no public exploit code or active exploitation has been identified at time of analysis; EPSS is 0.22% (12th percentile), and Google rates the underlying Chromium bug as Low severity. Note the sharp signal conflict that must be reconciled before prioritization: the nominal vendor CVSS is 8.3 while EPSS, vendor severity, and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) all point to materially lower real-world risk.
Site isolation bypass in Google Chrome for Android (versions prior to 155.0.8059.39) lets an attacker who has already compromised the renderer process cross the per-site process boundary and reach data that should remain isolated to other origins, triggered when the victim loads a crafted HTML page. It is a second-stage flaw rather than an initial-access vector: exploitation is gated on a separate, pre-existing renderer compromise plus required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), which is why the vendor assigned a Chromium severity of Low even though the base score is 8.2. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is only 0.21% (11th percentile); a vendor patch is available, so the residual risk is concentrated in unpatched Android clients that are simultaneously exposed to a first-stage renderer exploit.
Arbitrary code execution outside Chrome's sandbox on Android affects Google Chrome builds prior to 155.0.8059.39, where a missing authorization check (CWE-862) can be abused by a malicious co-installed Android app. The attack is local - it requires an attacker-controlled app to already be present on the same device plus successful social engineering to get the victim to install it and trigger the action - so a default, lone Chrome installation is not directly exploitable. Google rates this Chromium security severity Medium, the vendor CVSS is 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while our assessment substitutes UI:R, no publicly available exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is only 0.12% (2nd percentile).
Site isolation bypass in Google Chrome on Android (prior to 155.0.8059.39) allows an attacker who has already compromised the renderer process to reach the browser's Passwords component via a crafted HTML page and a missing authorization check, exposing stored credential data. The bug is a chained, second-stage issue: it cannot be triggered by an unprivileged remote attacker without pre-existing renderer code execution, and it requires user interaction to load the crafted page, which is why the assessed vector (AV:N/AC:H/PR:L/UI:R/C:H/I:N/A:N) makes realistic risk LOW despite the 8.1 base score. No public exploit identified at time of analysis, EPSS is only 0.21% (11th percentile), CISA SSVC records Exploitation: none, and Google rated the Chromium security severity Medium, so this is a routine patch-cycle fix rather than an emergency.
Remote attackers can bypass system access restrictions and reach a privileged internal page in Google Chrome for Android versions prior to 155.0.8059.39 by way of a confused-deputy weakness in the SignIn component, which performs privileged navigation on behalf of an untrusted caller. Exploitation requires the victim to load attacker-controlled crafted HTML (for example, visiting a malicious or compromised page), needs no authentication or prior privileges, and is limited to the Android build on pre-patch versions. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (12th percentile), and the issue is not confirmed as actively exploited; a vendor patch (155.0.8059.39) is available, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Incorrect authorization in the Search component of Google Chrome for Android before 155.0.8059.39 can allow a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim is socially engineered into opening a crafted HTML page. The vendor-rated Chromium severity is Medium, yet the assessed CVSS is 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the flaw crosses a security boundary (scope changed) with high confidentiality, integrity and availability impact. The risk signals conflict and must be weighed carefully: the impact score is severe, but exploitation requires a click of user interaction, is confined to Android builds (desktop Chrome is unaffected), and no public exploit code or confirmed active exploitation has been identified at the time of analysis. Vendor patches are available.
An integer overflow in the WebGL implementation of Google Chrome on Android lets a remote attacker potentially execute arbitrary code outside the browser sandbox on devices running any build prior to 155.0.8059.39. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning exploitation is unauthenticated but requires the victim to open an attacker-controlled HTML page that exercises the vulnerable WebGL code path; the scope change (S:C) reflects the potential escape from Chrome's renderer sandbox rather than a mere renderer crash. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none and Automatable: no, and a vendor patch exists, so the issue is high priority on impact and patch urgency rather than on observed exploitation. Because WebGL is enabled by default on Android Chrome, no special configuration is needed on the victim side beyond navigation to the malicious page.
Google Chrome on Android releases before 155.0.8059.39 mishandle Autofill reference resolution, allowing a remote attacker who socially engineers a victim into opening a crafted HTML page to read sensitive information held in the browser's Autofill store. The CVSS vector PR:N means no authentication is needed, but the required user interaction (UI:R) and social-engineering dependency are the main practical barriers; no public exploit code has been identified at time of analysis. Our independent assessment scores this as confidentiality-only (CWE-706, use of incorrectly-resolved name or reference), so it should be treated as an information-disclosure issue rather than code execution or data tampering.
A use-after-free race condition in the Android kernel's epoll teardown path (ep_free in eventpoll.c) lets a locally installed or otherwise compromised unprivileged app escalate to kernel-level privileges by reclaiming a freed eventpoll object before cleanup completes. The flaw is tracked as CVE-2026-56906 (CWE-362) with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires an existing low-privilege code-execution foothold and a successful, timing-sensitive race - no user interaction and no special product configuration are needed. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV absent; SSVC Exploitation='none', Automatable='no'), which places this in the second-tier priority band for most defenders.
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an attacker within Bluetooth radio range execute arbitrary code on unpatched Android devices, with no user interaction and no additional execution privileges required. The flaw is rated CVSS 9.8 under the vendor's AV:N vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); our independent assessment re-scores it AV:A because exploitation realistically requires the device's Bluetooth to be enabled and the attacker to be within radio range to deliver crafted CCC/GATT traffic, while agreeing that no authentication or victim action limits the attack. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and a fix is published in the Android/Pixel security bulletin dated 2026-10-01.
Authenticated command injection in Microsoft UFO's Mobile MCP server (ufo/client/mcp/http_servers/mobile_mcp_server.py) lets a caller holding a valid Mobile MCP API key smuggle shell metacharacters through the type_text text parameter and the launch_app package_name parameter; the adb client concatenates those values into a remote command string that the connected Android device re-parses, executing extra commands as the Android shell user. The issue affects UFO releases prior to 3.0.10 and, per the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector (8.8), requires authentication (PR:L) plus a reachable, already ADB-authorized device, while confining impact to Android shell-user privileges rather than host OS or root execution. No public exploit identified at time of analysis. Vendor-released patch: 3.0.10.
Authenticated command injection in Microsoft UFO's Mobile MCP server (versions prior to 3.0.9) lets a caller who holds a valid UFO_MCP_API_KEY pass shell metacharacters through the press_key tool's free-form key_code parameter and have them executed as the Android shell user on an already-authorized, connected device. Exploitation is remote and requires adb on the UFO host plus a reachable paired device, so it is not a host OS compromise, nor does it grant Android root - impact is bounded to Android shell-user privileges on the target handset. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis; the vendor has released a fix in version 3.0.9, and although the assigned CVSS is 9.1 (Critical), that score is driven largely by the scope change and network vector while the practical blast radius remains capped.
Remote unauthenticated attackers can make ViewSonic vCast fetch and install an attacker-supplied APK by abusing the vCast APK delivery mechanism's unauthenticated download endpoint to point the device at a malicious APK URL. Affected versions are vCast v0.0.0 through v3.2.715 inclusive on ViewSonic ViewBoard devices; the endpoint is network-reachable with no privileges and no user interaction, but the resulting installation is unprivileged, so the planted app runs as a normal application rather than with system/root rights. The supplied CVSS 3.1 base vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), while our independent assessment treats the practical impact as C:N/I:L/A:N because the outcome is unprivileged app installation; no public exploit identified at time of analysis and no CISA KEV active exploitation is indicated.
Local privilege escalation in the Android Settings component lets an attacker-controlled application that is already running on the device with low privileges (CVSS PR:L, AV:L) abuse a confused-deputy permission check and cause the more-privileged Settings process to perform operations on the caller's behalf, delivering high confidentiality and integrity impact with no user interaction required. Confirmed-affected builds are Android 14, Android 15, Android 16, and Android 16-qpr2, and the only vendor reference provided is the Android Automotive OS security bulletin for 2026-10-01, so the breadth of exposure across Android form factors should be confirmed with Google. There is no public exploit identified at time of analysis, and CISA's SSVC evaluation records exploitation as none, so this is a genuine but second-tier, local-only escalation path rather than a remotely reachable or actively exploited issue.
A permission bypass logic error in Android's DeviceAdminAppsPreferenceController.updateState allows a locally installed, running app to escalate privileges, granting it high confidentiality and integrity impact on affected devices (Android 14, 15, and 16-qpr2). Exploitation requires a local foothold consistent with the assessed CVSS vector (AV:L/PR:L) - the attacker must already have a malicious app executing on the device and be able to reach the device-admin apps preference code path - but no user interaction is needed, so the escalation can occur silently once that app is present. There is no remote attack vector, CISA SSVC records exploitation as 'none' and the flaw as non-automatable (cannot be reliably mass-exploited), and no public exploit code has been identified at time of analysis. This is a credible but not emergency-tier issue.
Local privilege escalation in the Android Settings application (the ApplicationActionButtonsPreferenceController handling app-uninstall controls) allows an attacker who already holds a low-privileged local foothold - such as a malicious or compromised app running in the standard app sandbox - to bypass a permission check and perform actions that should require elevated privileges, with no user interaction required. Affected versions are Android 14, 15, and 16-qpr2, as addressed by the October 2026 Android (Automotive OS) security bulletin; the exploit is only reachable locally (AV:L, PR:L, UI:N) and no public exploit code or active exploitation has been identified at time of analysis. The issue is a logic error in the shouldDisableUninstallButton routine rather than a memory-safety defect, and CISA SSVC rates exploitation as 'none' with 'no' automatable and total technical impact if successfully triggered.
Local privilege escalation in Android 14, 15, 16, 16-qpr2, and 17 allows an attacker with low-level local code execution - such as a pre-installed malicious or compromised app - to bypass permission checks and gain elevated privileges without user interaction, rated CVSS 7.8 (AV:L/PR:L/UI:N). The flaw is a logic error in permission management (CWE-269) tracked as CVE-2026-28625; no public exploit or active exploitation is identified at time of analysis. The only vendor reference is the Android Automotive OS security bulletin, so applicability to general Android handsets should be confirmed.
Remote denial of service in Google Android 14, 15, 16, 16 QPR2, and 17 allows an unauthenticated attacker to crash the device's message-parsing path and cause persistent disruption by sending a crafted MMS/WAP PDU that PduParser.java decodes without an adequate bounds check. Because MMS PDUs are parsed automatically upon receipt, no user interaction or credentials are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5); the only practical precondition is that the attacker can route an MMS to the victim's handset, which normally implies knowing the phone number and having carrier MMS reachability. CISA's SSVC evaluation records exploitation as none with no public exploit identified at time of analysis, although the flaw is classified as automatable, and impact is confined to availability (crash / persistent denial of service) with no confidentiality, integrity, or privilege gain.
Local privilege escalation in Google Android 17 (with a denial-of-service component) allows code running on the device with low-level privileges to trigger an uncaught exception in affected components, yielding high confidentiality, integrity, and availability impact. Per the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), exploitation requires a prior local foothold - typically a malicious or compromised third-party application already installed - and needs no user interaction and no additional execution privileges, but cannot be reached remotely over the network; the flaw is scoped to the Android 17 version named in the EUVD data. No public exploit identified at time of analysis.
Local privilege escalation in Google Android 14 through 17 (including 16-qpr2) arises from type-confusion memory corruption in multiple platform locations, letting a process that already has a low-privilege foothold on the device gain high-privilege code execution with confidentiality, integrity, and availability impact. Based on the CVSS vector (AV:L/AC:L/PR:L/UI:N), exploitation requires the attacker to already run code locally in a low-privileged context - a malicious or compromised app in its sandbox - and needs no user interaction and no special configuration; the flaw is reachable in default builds of the affected versions. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the issue as not automatable, and a vendor-released fix is available through the October 2026 Android Security Bulletin (patch level 2026-10-01), so this is a genuine but not emergency-grade priority - the key limiting factor is the need for an existing on-device foothold rather than remote reachability.
Local privilege escalation in Google Android 14 through 17 (including 16-QPR2) allows a low-privileged app already running on the device to bypass permission checks enforced inside VirtualAudioControllerTest.java and reach elevated functionality, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is strictly local: it requires an existing low-privileged execution context on the device, needs no user interaction, and is not remote. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV) at time of analysis, and CISA's SSVC evaluation rates exploitation as none with the issue judged not automatable.
Heap-based out-of-bounds write in Android's Bluetooth stack, specifically the cfg2prop routine in btif_storage.cc, can be triggered when the Bluetooth subsystem converts attacker-influenced bonded/stored device configuration data into Bluetooth properties, potentially leading to remote code execution. Affected builds are Android 16, Android 16-qpr2, and Android 17; the assessed vector requires low privileges (PR:L, consistent with a pairing/component-level context) and no user interaction, and real-world reachability is expected to be radio-adjacent (a nearby, paired, or spoofed Bluetooth device) rather than arbitrary internet access, even though the vendor-assigned vector carries AV:N. No public exploit code has been identified and SSVC records exploitation as none at time of analysis, but the flaw is memory-corruption class with total technical impact, so it warrants priority patching on devices where Bluetooth is enabled and pairing is common.
Local privilege escalation in Google Android 17 arises from an out-of-bounds write in the stpropnci_process function of stpropnci.cc, where an incorrect bounds check lets a low-privileged local process corrupt memory, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the attacker to already have local code execution on the device - an ordinary low-privileged app able to reach the vulnerable function and supply triggering input - after which no additional execution privileges and no user interaction are needed; there is no network-facing or remote trigger, so a foothold must first be obtained or the flaw chained behind a separate remote bug. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), making this a genuine but second-tier priority relative to remotely reachable Android flaws.
Memory corruption in Google Android 16, Android 16-qpr2, and Android 17 lets an attacker who already has low-privilege code executing on the device - for example a malicious or compromised installed app - turn uninitialized-memory handling into an out-of-bounds write and escalate to full privileges with no further execution privileges and no user interaction. The weakness is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which requires a pre-existing local foothold rather than a purely network-reachable entry point, and exploitation is only possible on builds that have not applied the 2026-10-01 Android security patch. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a high-priority patch item rather than an emergency, and it is not listed in CISA KEV.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2, and 17 lets a low-privilege app bypass permission checks through a confused-deputy flaw in the dialInternal code path, allowing the app to perform permission-protected actions it should not be able to perform. Exploitation requires a local foothold - the attacker must already be running code as a low-privilege app (PR:L) - but needs no user interaction (UI:N) and offers no remote attack surface (AV:L), making this a credible but not emergency-priority risk. There is no CISA KEV entry and no public exploit identified at time of analysis; patched builds from the October 2026 Android Security Bulletin are not vulnerable.
Local privilege escalation in Google Android 14, 15, 16, 16 QPR2 and 17 is possible through an out-of-bounds write in the qsort routine of libufdt_sysdeps_vendor.c, which occurs when the device-tree (ufdt) parsing path is driven into resource exhaustion with attacker-influenced input. An attacker who already holds a local, low-privileged foothold on the device - for example a malicious installed app or a process that can feed data into the ufdt parsing path (PR:L) - can trigger the flaw with no user interaction and no additional execution privileges, achieving high confidentiality, integrity and availability impact within the platform (CVSS 7.8). No public exploit identified at time of analysis, and the issue is addressed through the October 2026 Android Security Bulletin.
Local privilege escalation on Android 14, 15, 16, 16-qpr2, and 17 stems from an out-of-bounds read in MessageQueueBase.h caused by an incorrect bounds check, allowing an attacker with low-privilege local code execution to gain elevated privileges with high impact to confidentiality, integrity, and availability (CVSS 7.8). Exploitation requires a locally installed malicious or compromised app and no user interaction, and no public exploit has been identified at the time of analysis.
Local privilege escalation in Android's Bluetooth stack lets an app running with ordinary privileges corrupt control flow in the privileged Bluetooth process and inherit its elevated rights. The root cause is an uninitialized-pointer dereference (CWE-824) in handle_le_monitor_device_event of msft.cc, the Microsoft HCI vendor-extension handler, affecting Android 16, Android 16-qpr2 and Android 17 per EUVD. This is a second-stage escalation rather than a remote entry point: the attacker must already have local code execution and be able to reach the Bluetooth LE monitoring path (CVSS AV:L, PR:L, UI:N), and no public exploit code has been identified at time of analysis; Google addresses the issue in its October 2026 Android Security Bulletin.
Local privilege escalation in Google Android 14 through 17 (including 16 QPR2) lets a low-privilege local actor trigger an integer overflow inside the NFC Type 4 Tag read/write path (rw_t4t_update_file in rw_t4t.cc) that produces an out-of-bounds write, yielding code execution in a higher-privileged context. Per the assessed vector (AV:L/AC:L/PR:L/UI:N), the attacker must already have local code execution or app presence on the device but needs no user interaction, and exploitation requires attacker-controlled NFC Type 4 Tag data to reach the reader/writer code path on an unpatched build. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the CVSS score is 7.8 and the practical constraint is the local-only attack vector, making this a genuine fleet-patching priority rather than an emergency.
An out-of-bounds write in Android's NFC Execution Environment (NFCEE) action handling code (nfa_nfcee_act.cc) lets a locally installed low-privilege application corrupt memory in the NFC stack and escalate to system-level privileges. Per the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, the attacker must already be able to run code on the device as a low-privilege app (PR:L) and the flaw is not reachable over the network (AV:L), with no user interaction required; devices running unpatched Android 16, 16-qpr2, or 17 builds are affected, while those with the October 2026 security patch are not. Exploitation is not observed in the field - SSVC records Exploitation:none and there is no KEV listing or public exploit code identified at time of analysis - and EPSS is low at 0.11% (1st percentile), so this presents as a genuine but non-urgent local privilege-escalation issue rather than a remotely exploitable emergency.
An out-of-bounds write in Android's wpa_supplicant Robust AV / SCS action-frame handler (wpas_handle_robust_av_scs_recv_action in robust_av.c) can be turned into remote code execution on Android 14 through 17 (including 16-qpr2) devices that receive a crafted SCS action frame. Exploitation is sharply constrained: per the CVSS vector PR:H, the attacker must already hold System-level execution privileges on the target before the malformed frame is processed, and the independently assessed vector (AV:A) places the attacker in Wi-Fi/adjacent range rather than on arbitrary internet-routable paths. User interaction is not required (UI:N), and no public exploit code or CISA KEV entry has been identified at time of analysis; combined with the vendor score of 7.2 and the adjacent-vector reassessment, this rates as a moderate, not emergency, priority.
Local privilege escalation in Google Android 17 lets a locally installed, low-privileged application escape its sandbox and obtain system-level privileges by reaching the isSystem() routine in WifiPermissionsUtil.java, which fails to perform the required permission check (CWE-862). The flaw is rated CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting a changed-scope impact in which a compromised app in the application sandbox compromises the platform itself, with high confidentiality, integrity and availability effects and no user interaction required. An attacker must already have achieved local code execution on the device (for example through a malicious or trojanized app), and only Android 17 is listed as affected, so devices on other releases or on the October 2026 patch level are not exposed; no public exploit identified at time of analysis, and the issue is addressed through the Android Security Bulletin dated 2026-10-01.
Local privilege escalation in MediaTek NeuroPilot on affected chipsets (MT8781, MT8189, MT6993, MT8793, MT8910, MT8668, MT8188, MT6881, MT8875) allows an attacker with local code execution to trigger an out-of-bounds write in the APU/AI driver, potentially gaining high-integrity code execution with no user interaction, though no additional privileges are needed once that local app context exists. Vendor patch ALPS11249062 is available; no public exploit identified at time of analysis. It is a high-priority patch target for affected MediaTek-based devices but is not remotely reachable, limiting its scope to privilege escalation rather than initial compromise.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
A hardcoded API key ships inside the GeoVision GV-Eye Android application (V3.6.0) and can be recovered by reverse engineering the publicly distributed APK, allowing anyone who extracts it to invoke whatever GeoVision backend API operations that key authorizes. The impact is confidentiality-only (C:H, I:N, A:N) scoped to a single embedded credential, and the independent assessment scores it as a local-vector issue (AV:L) because the attacker must first obtain and analyze the client package. No public exploit code identified at time of analysis, and the CVE is not listed in CISA KEV; the practical damage ceiling depends on whether GeoVision rotates or revokes the leaked key on the server side.
Hardcoded API key exposure in the GeoVision GV-Eye Android application (V3.6.0) allows unauthenticated remote attackers to extract the key from the publicly distributable APK via reverse engineering and use it to access backend or third-party services, resulting in high confidentiality impact. With a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-798 classification, the vulnerability requires no user interaction or special privileges, though the actual blast radius is limited by the permissions associated with the single exposed key. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated extraction of permanent, plaintext cloud storage credentials from the Viidure Android dashcam companion application (CVE-2026-96587) gives any party who obtains the publicly distributed APK full read, write, and delete access to backend object storage holding operational files such as firmware and application binaries. Because the credentials are hardcoded in the shipped artifact and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation requires only network reachability to the storage endpoint plus routine decompilation of the app package - no victim interaction, authentication, or non-default configuration is needed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiter is the niche install base of this consumer dashcam app rather than any technical barrier; the independent assessment nevertheless flags this as a genuine high-priority finding because the exposure is architectural (server-side credential revocation is the only real containment) and write/delete scope against firmware could enable tampering with the update channel if the recovered keys retain that privilege.
Sandbox escape in Google Chrome's WebView component on Android (versions prior to 154.0.8037.92) lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by serving a crafted HTML page to the victim. The flaw is a second-stage, chain-completing bug rather than a standalone remote-compromise vector: it requires an existing renderer-level foothold, high attack complexity, and victim user interaction, which is why CISA's SSVC assessment marks exploitation as 'none', automatability as 'no', and Chromium rates its own security severity as Low despite a 7.5 CVSS base score. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; a vendor patch is available in Chrome 154.0.8037.92.
Remote code execution is possible in Google Chrome on Android builds prior to 154.0.8037.92, where a heap-based buffer overflow in the ANGLE graphics layer can be triggered when a user renders a crafted HTML page. Successful exploitation corrupts memory out of bounds and, per Google's Critical severity rating and the scope-changed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), can potentially execute arbitrary code outside the browser sandbox. The issue is remotely deliverable without authentication but hinges on user interaction, and no public exploit code or active exploitation has been identified at time of analysis; CISA's SSVC assessment likewise records no observed exploitation and rates the flaw non-automatable, while a vendor patch (154.0.8037.92) is available.
Command injection in Root Browser Classic 3.3.0 (Android, package com.jrummyapps.rootbrowser.classic) lets an attacker execute arbitrary shell commands with the app's privileges by supplying a SQLite database whose filename is seeded with shell metacharacters; the app passes that path to an operating-system shell without separating the filename from the command (CWE-78). Exploitation is local rather than remote: the crafted file must first reach the device (download, sideload, shared storage or another app) and the victim must then open it inside the app, so the flaw is gated by passive user interaction and confined to users of this root-capable file manager. No public exploit code was identified at time of analysis, and while exploitation yields high confidentiality, integrity and availability impact, the 8.5 CVSS v4.0 base score overstates the practical exposure because the realistic attack surface is narrow.
UI spoofing in Arc Search for Android before 1.12.10 lets an unauthenticated remote attacker use a crafted webpage that enters fullscreen while the app is backgrounded to suppress the return-from-background fullscreen notification and render fake browser UI, such as a spoofed address bar. The victim must visit the attacker-controlled page and be deceived by the spoofed origin, so exploitation requires user interaction and carries no confidentiality or availability impact, though integrity impact is high for phishing. No CISA KEV listing or public exploit code was identified at time of analysis; CVSS 3.1 base score is 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malicious JavaScript inside a vulnerable form field, which then executes in the browser of any user who later browses to the page rendering that field - enabling session or account takeover inside the victim's browser context. Adobe rates the flaw 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent analysis assesses it more conservatively as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because the injection step realistically requires prior authenticated content-submission or authoring access and a victim must still be drawn to the affected page; impact is bounded by the victim's browser session rather than direct server compromise. There is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
DesktopSMS 1.11.0 (MrPear) exposes a local/loopback service that performs privileged SMS operations - sending messages, returning SMS-derived content, and persisting a paired identity - without any pairing confirmation, authentication, or user interaction, so any process already running on the same device can exercise the victim app's SMS permissions. Exploitation is strictly local: an attacker must first have code execution on the device (a co-installed malicious app, or ADB/loopback access), which is why the assessed vector is AV:L with PR:N and UI:N but a hard device-foothold prerequisite. Publicly available exploit code exists (a proof-of-concept client has been published), and while no confirmed active exploitation is recorded, the low complexity and absence of user interaction make this a practical post-foothold privilege-escalation primitive against the app's SMS capabilities.
Command injection within Acode on Android lets any locally installed application execute arbitrary shell commands inside Acode's own sandboxed UID, exposing private app data, stored remote credentials, Storage Access Framework grants and granted runtime permissions. The flaw affects builds from 1.11.6 up to but not including 1.12.7, where the terminal plugin exports com.foxdebug.acode.rk.exec.terminal.TerminalService without a binding permission and TerminalService.java performs no caller verification, so a zero-permission hostile app can bind the service and pass an attacker-controlled cmd value via MSG_EXEC. Exploitation is strictly local and requires the victim to already have run a malicious app alongside a vulnerable Acode release; no public exploit code has been identified at time of analysis and there is no CISA KEV listing or EPSS signal reported.
Use-after-free in the Dawn (WebGPU) component of Google Chrome on Android before 153.0.8010.52 allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim renders a crafted HTML page. Exploitation requires the user to load attacker-controlled content (CVSS 9.6, AV:N/AC:L/PR:N/UI:R), and Google rates the bug Chromium security severity Critical; the only affected configuration is Chrome on Android below the fixed 153.0.8010.52 build, and devices already updated are not exposed. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by the size of the unpatched Android install base rather than by observed attacks.
Remote code execution outside the browser sandbox in Google Chrome on Android prior to 153.0.8010.52 is possible when a victim opens a crafted HTML page containing malicious WebGL content that triggers a stack-based buffer overflow. Unauthenticated remote attackers can achieve code execution in the context of the GPU/renderer process with high impact to confidentiality, integrity, and availability, though exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6, Chromium security severity Critical). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Google has released a fixed build (153.0.8010.52) and the flaw is tracked as EUVD-2026-82476 and VulDB 407131.
Improper input validation in multiple locations of the Android kernel allows a locally installed application to escalate privileges on affected Pixel and Android devices, with no additional execution privileges or user interaction required. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attacker who already holds low-privileged code execution but can reach high-integrity kernel operations. It is addressed in the September 2026 Android/Pixel security bulletin; at time of analysis there is no CISA KEV listing, no confirmed public exploit code, and no EPSS signal was supplied with the source data.
An out-of-bounds read in the Android hardware VP9 decode path (Vp9DecEndOfStream in vp9hwd_output.cc) permits a locally installed app that can feed a crafted VP9 bitstream to the platform decoder to read memory beyond the intended buffer, leaking process data. Exploitation requires a local foothold (AV:L) - an app already running on the device - but no additional privileges (PR:N) and no user interaction (UI:N); the flaw is confined to devices using Google/Tensor's hardware VP9 decode implementation and is not remotely exploitable. Independent reassessment of the impact narrows this to information disclosure (C:H/I:N/A:L) rather than the vendor's code-execution framing, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.11% (2nd percentile), indicating very low predicted real-world exploitation activity.
Local privilege escalation in the Pixel-specific kernel PHY power driver, specifically the gmc_phy_lp3_exit_restore_registers routine in phy_power.c, where a missing bounds check permits an out-of-bounds memory write (CWE-120). Reaching the vulnerable code path requires code already executing at Android System privilege level on an affected Pixel device, and no user interaction is needed once that context is held; per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) this is an authenticated/high-privilege local issue rather than an unprivileged-app primitive, making it most useful as a later stage in an exploit chain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available through the September 2026 Pixel security bulletin.
Local privilege escalation in the Android kernel's FsmReleaseKey routine allows a malicious or compromised app already running on a Pixel device to bypass permission checks and gain kernel-level access, affecting confidentiality, integrity, and availability. Exploitation requires no credentials, no elevated privileges, and no user interaction (CVSS 8.4, AV:L/PR:N/UI:N), so any unpatched build predating the 2026-09-01 Pixel security patch level is exposed. No public exploit identified at time of analysis and EPSS is low at 0.12% (2nd percentile), so this is a genuine but non-urgent patching priority rather than an active threat.
Local privilege escalation in Google Android allows an unprivileged app already running on the device to trigger a heap buffer overflow in the gf_ta_test_set_config routine of gf_ta_test.c, potentially gaining elevated code execution within the affected component. The flaw carries CVSS 8.4 (AV:L/AC:L/PR:N/UI:N, C/I/A High), requires on-device execution but no elevated privileges or user interaction, and affects Android builds where the vulnerable fingerprint/trusted-application test/config code is present. EPSS is very low at 0.12% (2nd percentile), no public exploit identified at time of analysis, and the issue is fixed in the 2026-09-01 Pixel security patch level.
Privilege escalation in the Android Bootloader allows a local attacker who already holds System execution privileges to bypass an intended permission check and obtain higher-privileged code execution on affected devices. The root cause is a logic error in bootloader permission enforcement (CWE-693, protection mechanism failure) that requires no user interaction and is reachable only through local access, making it a privilege-escalation link inside a larger exploit chain rather than a standalone remote threat; the affected scope appears limited to Google Pixel devices addressed by the 2026-09-01 Pixel security bulletin. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data accompanied the available reporting.
Privilege escalation in the Android Setup Wizard (Google Android, fixed in the September 2026 Pixel bulletin) lets a locally-running, low-privilege app trigger a package installation because the Setup Wizard's install code path performs a missing permission check. Per the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, exploitation requires code already executing on the device under a low-privileged context, needs no user interaction and no additional execution privileges, and yields high confidentiality and integrity impact in a local attack. Despite the advisory's 'remote package install' phrasing, the CVSS vector confirms this is not a network-reachable attack, and no public exploit has been identified at time of analysis.
Improper input validation in the Android modem/baseband allows an attacker who can deliver crafted radio-layer signaling to the device to cause information disclosure, scored 7.5 (HIGH) under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The affected component is the cellular modem in Google Android, reported by Google Devices and published in the Pixel security bulletin dated 2026-09-01 (EUVD-2026-78991); default configurations are exposed once the handset attaches to an attacker-controlled radio environment, and no on-device privileges or user interaction are required. Although the vector is network-rated, practical exploitation requires RF proximity and specialized SDR/IMSI-catcher-class hardware rather than arbitrary internet reachability, and impact is confined to confidentiality with no code execution or integrity/availability effect. Risk is tempered by the absence of confirmed active exploitation and an EPSS score of only 0.24% (15th percentile), so no public exploit was identified at the time of analysis.
Local privilege escalation in Google Android affects Pixel builds addressed by the 2026-09-01 Android/Pixel security bulletin, where an unprivileged app already running on the device can trigger an out-of-bounds read caused by type confusion and potentially gain elevated code execution. The issue is locally reachable with no user interaction and no prior privileges (CVSS:3.1/AV:L/AC:L/PR:N/UI:N), but an attacker must first get malicious code onto the device, so exposure is largely limited to users who sideload apps or run compromised applications. There is no CISA KEV listing and no public exploit code identified at time of analysis, and exploitation risk is low per EPSS at 0.11% (2nd percentile). The flaw was reported by Google Devices and tracked in the EU as EUVD-2026-78985.
Local privilege escalation in Google Android and Pixel builds lets an already-installed, unprivileged app leverage a type-confusion flaw in multiple system files to obtain signature data it should not be able to reach, escalating to a higher-privileged context. The attack is purely local: per the CVSS vector (AV:L/PR:N/UI:N) no credentials, elevated privileges, or user interaction are required beyond getting a malicious app running on the device, though the attacker must first sideload or distribute that app through a store listing. Exploitation is not confirmed as active, no public exploit code has been identified, and the EPSS score is very low (0.11%, 2nd percentile), making this a genuine but moderate-priority local privilege-escalation issue rather than a mass-exploitation threat; vendor patches are addressed in the 2026-09-01 Pixel security bulletin.
Local privilege escalation in the Android VPU (Video Processing Unit) component lets an attacker who already holds low-privilege code execution - such as a malicious or compromised app running on the device - bypass a missing permission check and elevate to System-level execution privileges, with no user interaction required. The flaw is assessed at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) and was reported by Google Devices against the Pixel security bulletin, so real-world exposure centers on Pixel hardware that exposes the affected VPU subsystem rather than all devices matching the broad google:android CPE. EPSS is only 0.12% (2nd percentile) and no public exploit identified at time of analysis; impact is bounded to System privileges, not full kernel or root.
Out-of-bounds read in the Android kernel's configuration accessor get_global_config_item_addr() in gc.c allows a local attacker to read memory past the end of an allocation because the routine never validates the requested item index against the bounds of the config region. Google assigns the issue High severity (CVSS 8.4, vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting that it can be reached with no additional execution privileges and no user interaction and can be leveraged toward local escalation of privilege on the affected device. Current intelligence does not indicate active exploitation: EPSS is only 0.11% (2nd percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV; fixes shipped in the September 2026 Android/Pixel security bulletin (2026-09-01), making this a genuine but not urgent local privilege-escalation issue.
Local privilege escalation in the Android kernel allows an unprivileged app already running on a Pixel or other affected Android device to bypass a missing permission check and gain elevated privileges, resulting in full compromise of confidentiality, integrity, and availability (CVSS 8.4, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the vector is local-only and requires the attacker to already execute code on the device, the exposure is limited to post-compromise or malicious-app scenarios rather than remote attacks, and no user interaction is needed once that foothold exists. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable); EPSS is low at 0.12% (2nd percentile), and the September 2026 Android/Pixel security patch level (2026-09-01) contains the fix. Vendor-assigned severity is High, driven by the complete loss of C/I/A from a low-privilege starting point.
A heap-based buffer overflow (out-of-bounds write) exists in the Android Cellular Modem component, allowing an attacker within adjacent/proximal radio range to corrupt heap memory and potentially execute code in the modem context without user interaction. The flaw carries a CVSS base score of 8.0 (AV:A/AC:L/PR:L/UI:N) and affects Google Android devices per the Android/Google Devices CPE. No public exploit code or CISA KEV listing was provided at time of analysis, so exploitation status is unconfirmed; the vendor fix is documented in the September 2026 Pixel/Android Security Bulletin.
Use-after-free (CWE-416) in the Android kernel allows a remote attacker to escalate privileges to kernel level on affected Pixel and Android devices, with no authentication, no user interaction, and no additional execution privileges required per the CVSS vector. Google rates this 9.8 (AV:N/AC:L/PR:N/UI:N) in its September 2026 Pixel security bulletin, while independent assessment lowers the practical rating to 8.1 (AC:H) because successful exploitation must first reach the vulnerable kernel code path and then defeat Android kernel memory-corruption mitigations such as KASLR, allocator hardening, and CFI. EPSS is only 0.16% (5th percentile) and there is no CISA KEV entry and no public exploit identified at time of analysis, so exploitation is currently considered possible but not observed.
Local privilege escalation in Google Android's fingerprint TEE HAL allows an unprivileged app already running on an affected Pixel/Android device to trigger a use-after-free in fpc_tee_hal.c and gain elevated code execution. Exploitation requires local code execution as a prerequisite, no user interaction, and no additional execution privileges; it is not remotely triggerable. No public exploit code has been identified at time of analysis, and EPSS is 0.12% (2nd percentile), indicating low predicted exploitation activity despite the 8.4 CVSS score. Devices are affected if they include the Fingerprint Cards TEE HAL and have not been updated to the 2026-09-01 Android/Pixel security patch level.
Local privilege escalation in the Android kernel affecting Google/Pixel devices lets an unprivileged app already running on the device trigger a use-after-free and gain elevated privileges. The flaw stems from improper locking in a kernel code path (CWE-416), and no user interaction is required; however, an attacker must first have local code execution on the device and must win a locking race to corrupt kernel memory, which adds real-world reliability constraints. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.11% (2nd percentile), so this is a genuine but not urgent local privilege-escalation issue confined to devices running kernel builds older than the 2026-09-01 patch level.
Local privilege escalation in the Android kernel's remap.c enable_segment path allows an unprivileged app to bypass segment permissions and gain elevated privileges on affected Pixel and Android devices (CVSS 8.4, High). Exploitation requires only an app-level foothold with no user interaction, and no public exploit code has been identified at time of analysis; EPSS is low at 0.13% (3rd percentile). Devices at a pre-2026-09-01 patch level remain at risk and are fixed by the Android Security Bulletin dated 2026-09-01.
Authentication bypass in Android's IP Multimedia Subsystem (IMS) telephony stack lets an attacker who can reach a device's IMS/SIP signaling path escalate privileges remotely, with no user interaction and no prior authentication required per the vendor vector (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is a logic error (CWE-693, Protection Mechanism Failure) affecting unpatched Android builds - the CPE entry covers all Android versions until the 2026-09-01 security patch level is applied. Exploitation in practice most plausibly requires an adjacent or carrier-network foothold, such as a compromised or malicious IMS core or a rogue base station, because the vulnerable path is the telephony signaling channel rather than an arbitrary Internet-facing service; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low (0.20%, 10th percentile), so the high severity stems from the potential impact if reachable rather than from observed exploitation.
Out-of-bounds write in Android's IMS media audio decoder (decodeAmr() in ImsMediaAudioPlayer.cpp) lets a remote party in an IMS-based media session - such as a VoLTE or VoWiFi call carrying crafted AMR-encoded audio - corrupt memory and potentially achieve remote code execution on the device. Affected are Android devices with an active IMS media stack (CPE cpe:2.3:a:google:android:*), and exploitation requires user interaction because the victim must answer or join the call/media session, which significantly limits mass exploitation. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the EPSS score is low (0.21%, 12th percentile), so this is best treated as a serious but currently latent memory-corruption risk pending the September 2026 Android/Pixel security bulletin fix.
Denial of service in the cellular modem of Google Android devices allows a radio-adjacent attacker to disrupt or crash baseband connectivity by sending crafted, malformed signaling input over the radio interface. The flaw is an improper input validation issue (CWE-20) rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no authentication or user interaction is required once the attacker has radio reach, though exploitation requires a rogue or compromised base station, IMSI-catcher, or signaling injection capability within RF range of an active cellular connection. No public exploit identified at time of analysis, and EPSS is 0.25% (16th percentile), indicating a low predicted likelihood of exploitation; impact is limited to availability (recoverable modem/connectivity denial of service) with no confidentiality, integrity, code execution, or persistence impact.
An out-of-bounds write in the Wave6 VPU video-decoder driver (Wave6VpuDecFlush in wave6.c) lets an unprivileged local app corrupt kernel memory on affected Android devices, escalating to kernel-level privilege and full device compromise. The flaw requires local code execution - an attacker must already be able to run code on the device and reach the decoder's flush routine - but needs no user interaction and no prior elevated privileges (AV:L, PR:N, UI:N). It is not known to be actively exploited, has no identified public exploit code at time of analysis, and carries a low EPSS score of 0.11% (2nd percentile), making it a serious but locally-scoped privilege-escalation issue rather than an internet-facing emergency.
Local privilege escalation in the Android kernel (CVE-2026-0194) arises from an integer overflow that enables a permission bypass, allowing code already running on a device to elevate its privileges. The issue is local in scope: the assessed vector is AV:L/PR:L, meaning an attacker must first be able to execute code on the handset - for example through an installed malicious or compromised app - after which the overflow can be triggered with no user interaction and, per the description, no additional execution privileges. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at roughly 0.12 percent (2nd percentile), and remediation is delivered through the September 2026 Pixel/Android security bulletin.
Local privilege escalation in Google Android's init process allows an unprivileged local app to bypass an access-control policy and gain elevated privileges on affected Android/Pixel builds. The root cause is a logic error in the ac_init_policy routine in init.c, tracked as CWE-693 (protection mechanism failure), and the vendor scores it 8.4 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - no user interaction, no privileges required (PR:N), and no non-default configuration needed, though the attack is strictly local and requires the attacker to first get code running on the device. No public exploit code has been identified at time of analysis and EPSS is low (0.13%, 3rd percentile), so active exploitation is not confirmed; a fix is covered by the September 2026 Android/Pixel security bulletin.
Sensitive health-data exposure in the Lenovo Health Android application (distributed exclusively in the Chinese market) stems from hardcoded credentials (CWE-798) that let an attacker access users' health-related information without legitimate authentication. Reported by Lenovo PSIRT and tracked under a single Lenovo advisory, it carries a CVSS 4.0 base of 9.3 driven by high confidentiality impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Improper export of Android application components in Lenovo File Manager (Chinese-market distribution) enables a locally authenticated user or co-installed application to read or modify files that the application designates as protected. The root cause is CWE-926, where one or more Android components - likely a content provider or activity - are exported without enforcing the application's own authorization logic. No public exploit code exists and the vulnerability has not been added to CISA KEV; however, the CVSS 4.0 score of 8.4 reflects genuine high-impact file access if an attacker can install a companion malicious application on the target device.
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to execute arbitrary code with system server privilege. The flaw resides in Samsung's proprietary Mobile Display Image Enhancement (mdnie) library, which is accessible from low-privilege application contexts with no special Android permissions required. No public exploit has been identified at time of analysis, and Samsung addressed this in the September 2026 Monthly Security Release (SMR Sep-2026 Release 1).
Denial of service in lottie-android 6.7.1 and earlier allows remote attackers to crash or hang applications by supplying a crafted Lottie animation JSON that contains a cyclic precomposition reference graph, which triggers uncontrolled recursion during layer model construction in BaseLayer.forModel and CompositionLayer. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) confirms unauthenticated, network-reachable availability impact with no confidentiality or integrity effect. No CISA KEV entry or public exploit code has been identified at time of analysis, but exploitation requires the host application to parse untrusted or remote Lottie files; applications rendering only bundled, trusted animations are not exposed.
SmsForwarder through 3.5.0 exposes an AndServer-based HTTP remote-control interface whose API endpoints are enabled by default and perform no authentication check, allowing anyone who can reach the device's listener on an adjacent network to read SMS messages, call logs and contacts, send SMS on the victim's behalf, and export or overwrite the app's configuration via the clone API. The supplied CVSS 4.0 vector (AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N) and the independent assessment agree that exploitation is unauthenticated and requires no user interaction, but is constrained to an adjacent network path such as the same LAN or Wi-Fi segment rather than arbitrary internet reachability. The vulnerability is not listed in CISA KEV and no public exploit code was identified at time of analysis; no EPSS score, no vendor CVSS 3.1 vector, and no explicit POC flag were provided, so those prioritization signals remain unknown rather than assumed.
Multiple Rakuten Mobile Android handsets - Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten Bigs - ship with AOSP default test keys still trusted by Android Verified Boot, so a system image signed with those publicly known keys passes boot integrity verification instead of being rejected. An attacker with physical possession of the handset and the ability to enter its flashing/fastboot mode can therefore install a crafted system image and gain full control of confidentiality, integrity, and availability (VC:H/VI:H/VA:H), which is the basis for the CVSS 4.0 base score of 7.0 (HIGH), gated heavily by the AV:P physical-access prerequisite. There is no public exploit code identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); the risk is concentrated in lost, stolen, seized, or resold devices rather than any remote or network-reachable attack path.
Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).
A stack-based buffer overflow in the Microsoft Graphics Component, reachable through Microsoft Office for Android, lets an authenticated attacker who can place a crafted document or graphics object in front of a victim gain code execution in the context of the mobile app, with high impact to confidentiality, integrity, and availability. Only builds from 16.0.1 up to but not including 16.0.20430.20000 are affected, and exploitation requires user interaction - the victim must open or render the malicious file - which materially narrows the practical attack surface despite the 8.0 CVSS score. At time of analysis there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified; the vendor has published an update-guide entry, so affected organizations should treat this as a credible mid-to-high priority patching item rather than a top-tier emergency.
An origin validation error (CWE-346) in Microsoft Power Apps allows an authenticated attacker to achieve remote code execution against affected client deployments by inducing a legitimate user to interact with attacker-controlled content. Only Microsoft Power Apps for Android before 3.26085.7 and Power Apps 1710 (9.2.23071.136) before 2608.5 are affected; patched builds are not vulnerable. Exploitation requires a valid authorized identity in the Power Apps environment (PR:L) plus victim interaction (UI:R), CISA's SSVC assessment records no observed exploitation and rates the attack as not automatable, and no public exploit identified at time of analysis; treat this as an elevated-priority but non-emergency patch item.
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Local code execution in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows an unprivileged local attacker to execute arbitrary code by supplying a crafted HEIF image on devices running firmware prior to SMR Oct-2026 Release 1. The flaw is an improper input validation issue in the 'sheifd' parsing path, rated 8.6 (CVSS 4.0) with high confidentiality, integrity, and availability impact. No public exploit code has been identified at the time of analysis, and the local attack vector requires the malicious file to be delivered from an on-device context.
Local code execution in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows unprivileged attackers to run arbitrary code by supplying a crafted HEIF cover image. This improper input validation flaw, tracked as CVE-2026-21124, affects Samsung devices prior to the SMR Oct-2026 Release 1 security update and carries a CVSS 4.0 score of 8.6, indicating high confidentiality, integrity, and availability impact. No public exploit code has been identified at time of analysis, and patched devices are not affected.
An out-of-bounds write in the native library libsamsungtts.so, part of the Samsung Text-to-Speech engine shipped on Samsung Android builds, allows code running locally on the device to corrupt memory and achieve arbitrary code execution in the TTS process context. The vulnerable component is reachable without special privileges or user interaction (CVSS 4.0 PR:N/UI:N), but the attack vector is local (AV:L), so the attacker must already have a malicious or compromised app or local process able to invoke the TTS engine and supply crafted input; there is no remote/network exploitation path. Samsung addresses the flaw in the SMR Oct-2026 Release 1 maintenance update, and no public exploit code has been identified at time of analysis.
Local privilege escalation in Samsung's WSM service lets a malicious or compromised process already running on the device trigger a use-after-free and execute arbitrary code with system-level privileges. The flaw affects Samsung mobile firmware builds released before SMR Oct-2026 Release 1; remote network exploitation is not possible because the attacker must first have local code execution able to reach the WSM interface. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), but the cross-boundary impact (scope change with high confidentiality, integrity and availability impact) makes prompt installation of the October 2026 security maintenance release the priority for any unpatched device.
Out-of-bounds write in Samsung's libsmkvextractor.so media-extraction library allows arbitrary code execution on Samsung mobile devices running firmware prior to SMR Oct-2026 Release 1. Exploitation requires local access - an attacker must already hold a foothold on the device or get a crafted MKV/Matroska media file into a local parsing path - yet the CVSS 4.0 vector requires no privileges and no user interaction (AV:L/PR:N/UI:N), and our independent CVSS 3.1 assessment (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) rates the impact as high integrity, low confidentiality, and low availability. No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV.
OS command injection in CellHubs 'ExifTool for photo and video' 5.0.1-gms allows code execution within the app's own sandbox when a media file whose path or filename contains an embedded single quote and shell metacharacters is selected and exported to CSV. The app builds a shell string and passes it to /system/bin/sh -c, wrapping the media path in single quotes without escaping embedded single quotes, so the quoting can be broken out of and the remaining characters interpreted as shell commands. Exploitation is local and requires user interaction: the malicious file must already reside on the device and the victim must manually select it and trigger CSV export; the vulnerability received an assessed CVSS:3.1 score of 8.4 (equivalent 4.0 vector AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H), and no public exploit code or confirmed active exploitation has been identified at time of analysis. Authentication requirements are unauthenticated per the CVSS vector (PR:N), meaning no prior privilege on the device is needed for an attacker who can plant the crafted file.
Information disclosure in the HPE Networking ClearPass Policy Manager Android client application allows an unauthenticated remote attacker to invoke improperly access-controlled application functionality from an untrusted source, potentially exposing sensitive information held on or accessible to the victim's mobile device. Exploitation requires the ClearPass Android client to be installed plus mandatory victim interaction (UI:R) with attacker-supplied content - for example a malicious co-installed app, crafted intent, deep link, or content - so delivery likely relies on an Android inter-component path rather than direct internet-facing exposure, and no public exploit was identified at time of analysis. Note that the vendor-supplied CVSS 3.1 vector (8.8, C:H/I:H/A:H) overstates the issue relative to the described confidentiality-only impact; our independent assessment limits the score to AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Information disclosure in Google Chrome for Android lets a remote attacker who successfully socially engineers a victim into opening a crafted HTML page expose sensitive data handled by the browser's Passwords component; builds prior to 155.0.8059.39 are affected, and no authentication or non-default configuration is required. The vendor classifies the issue as Low severity (CWE-200) and no public exploit code was identified at time of analysis. Note that the supplied CVSS base score of 8.8 (C:H/I:H/A:H) is inconsistent with the information-disclosure description and the vendor's Low rating; our independent assessment scores it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, i.e. a confidentiality leak that strictly depends on user interaction.
Google Chrome for Android prior to 155.0.8059.39 contains an incorrect-authorization flaw in its Transactions Platform component that lets an unauthenticated remote attacker read sensitive information from the browser by luring the victim into opening a crafted HTML page. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, though the attack is fully remote (AV:N/PR:N) and requires only that a user on a vulnerable Android build load the attacker's page (UI:R). Note that public severity signals conflict: the vendor rates this Chromium security severity 'Low' and limits impact to information disclosure, while a widely replicated CVSS 3.1 base score of 8.8 lists high integrity and availability impact that is not supported by the description - our independent assessment scores it 8.8-adjacent only on confidentiality (C:H/I:N/A:N).
Information disclosure in Google Chrome for Android (versions prior to 155.0.8059.39) allows remote, unauthenticated attackers to reach sensitive data held by the browser's Autofill feature via a crafted HTML page, with the flaw rooted in incorrect authorization (CWE-863) in the Autofill path. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), exploitation requires the victim to actively navigate to the attacker's page and the impact is confined to confidentiality, with no integrity or availability effect; the vendor-supplied 8.8 score (C:H/I:H/A:H) and the 'Low' Chromium severity conflict with this assessment and should be reconciled before prioritization. Chrome on Android is the affected build, no public exploit was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Origin policy bypass in Google Chrome for Android prior to 155.0.8059.39 lets a remote attacker acting through a confused deputy have actions carried out under a different web origin's authority, so a victim who is socially engineered into opening a crafted HTML page can have that page reach resources or capabilities it should never hold for its own origin. Only Chrome on Android is affected, exploitation is not silent (it requires the user to open attacker-supplied content, CVSS PR:N/UI:R), and no public exploit code or active exploitation has been identified at time of analysis; EPSS is 0.22% (12th percentile), and Google rates the underlying Chromium bug as Low severity. Note the sharp signal conflict that must be reconciled before prioritization: the nominal vendor CVSS is 8.3 while EPSS, vendor severity, and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) all point to materially lower real-world risk.
Site isolation bypass in Google Chrome for Android (versions prior to 155.0.8059.39) lets an attacker who has already compromised the renderer process cross the per-site process boundary and reach data that should remain isolated to other origins, triggered when the victim loads a crafted HTML page. It is a second-stage flaw rather than an initial-access vector: exploitation is gated on a separate, pre-existing renderer compromise plus required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), which is why the vendor assigned a Chromium severity of Low even though the base score is 8.2. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is only 0.21% (11th percentile); a vendor patch is available, so the residual risk is concentrated in unpatched Android clients that are simultaneously exposed to a first-stage renderer exploit.
Arbitrary code execution outside Chrome's sandbox on Android affects Google Chrome builds prior to 155.0.8059.39, where a missing authorization check (CWE-862) can be abused by a malicious co-installed Android app. The attack is local - it requires an attacker-controlled app to already be present on the same device plus successful social engineering to get the victim to install it and trigger the action - so a default, lone Chrome installation is not directly exploitable. Google rates this Chromium security severity Medium, the vendor CVSS is 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while our assessment substitutes UI:R, no publicly available exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is only 0.12% (2nd percentile).
Site isolation bypass in Google Chrome on Android (prior to 155.0.8059.39) allows an attacker who has already compromised the renderer process to reach the browser's Passwords component via a crafted HTML page and a missing authorization check, exposing stored credential data. The bug is a chained, second-stage issue: it cannot be triggered by an unprivileged remote attacker without pre-existing renderer code execution, and it requires user interaction to load the crafted page, which is why the assessed vector (AV:N/AC:H/PR:L/UI:R/C:H/I:N/A:N) makes realistic risk LOW despite the 8.1 base score. No public exploit identified at time of analysis, EPSS is only 0.21% (11th percentile), CISA SSVC records Exploitation: none, and Google rated the Chromium security severity Medium, so this is a routine patch-cycle fix rather than an emergency.
Remote attackers can bypass system access restrictions and reach a privileged internal page in Google Chrome for Android versions prior to 155.0.8059.39 by way of a confused-deputy weakness in the SignIn component, which performs privileged navigation on behalf of an untrusted caller. Exploitation requires the victim to load attacker-controlled crafted HTML (for example, visiting a malicious or compromised page), needs no authentication or prior privileges, and is limited to the Android build on pre-patch versions. No public exploit code has been identified at time of analysis, EPSS is low at 0.22% (12th percentile), and the issue is not confirmed as actively exploited; a vendor patch (155.0.8059.39) is available, so this is a moderate-priority patch-and-move-on item rather than an emergency.
Incorrect authorization in the Search component of Google Chrome for Android before 155.0.8059.39 can allow a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim is socially engineered into opening a crafted HTML page. The vendor-rated Chromium severity is Medium, yet the assessed CVSS is 9.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) because the flaw crosses a security boundary (scope changed) with high confidentiality, integrity and availability impact. The risk signals conflict and must be weighed carefully: the impact score is severe, but exploitation requires a click of user interaction, is confined to Android builds (desktop Chrome is unaffected), and no public exploit code or confirmed active exploitation has been identified at the time of analysis. Vendor patches are available.
An integer overflow in the WebGL implementation of Google Chrome on Android lets a remote attacker potentially execute arbitrary code outside the browser sandbox on devices running any build prior to 155.0.8059.39. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning exploitation is unauthenticated but requires the victim to open an attacker-controlled HTML page that exercises the vulnerable WebGL code path; the scope change (S:C) reflects the potential escape from Chrome's renderer sandbox rather than a mere renderer crash. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none and Automatable: no, and a vendor patch exists, so the issue is high priority on impact and patch urgency rather than on observed exploitation. Because WebGL is enabled by default on Android Chrome, no special configuration is needed on the victim side beyond navigation to the malicious page.
Google Chrome on Android releases before 155.0.8059.39 mishandle Autofill reference resolution, allowing a remote attacker who socially engineers a victim into opening a crafted HTML page to read sensitive information held in the browser's Autofill store. The CVSS vector PR:N means no authentication is needed, but the required user interaction (UI:R) and social-engineering dependency are the main practical barriers; no public exploit code has been identified at time of analysis. Our independent assessment scores this as confidentiality-only (CWE-706, use of incorrectly-resolved name or reference), so it should be treated as an information-disclosure issue rather than code execution or data tampering.
A use-after-free race condition in the Android kernel's epoll teardown path (ep_free in eventpoll.c) lets a locally installed or otherwise compromised unprivileged app escalate to kernel-level privileges by reclaiming a freed eventpoll object before cleanup completes. The flaw is tracked as CVE-2026-56906 (CWE-362) with a CVSS 3.1 base score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), meaning exploitation requires an existing low-privilege code-execution foothold and a successful, timing-sensitive race - no user interaction and no special product configuration are needed. There is no public exploit code identified at time of analysis and no confirmed active exploitation (CISA KEV absent; SSVC Exploitation='none', Automatable='no'), which places this in the second-tier priority band for most defenders.
A use-after-free in the Android Bluetooth stack (bluetooth_ccc.cc, function BluetoothCccHandlerCallbackImpl) lets an attacker within Bluetooth radio range execute arbitrary code on unpatched Android devices, with no user interaction and no additional execution privileges required. The flaw is rated CVSS 9.8 under the vendor's AV:N vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H); our independent assessment re-scores it AV:A because exploitation realistically requires the device's Bluetooth to be enabled and the attacker to be within radio range to deliver crafted CCC/GATT traffic, while agreeing that no authentication or victim action limits the attack. No public exploit code and no confirmed in-the-wild exploitation have been identified at time of analysis, and a fix is published in the Android/Pixel security bulletin dated 2026-10-01.
Authenticated command injection in Microsoft UFO's Mobile MCP server (ufo/client/mcp/http_servers/mobile_mcp_server.py) lets a caller holding a valid Mobile MCP API key smuggle shell metacharacters through the type_text text parameter and the launch_app package_name parameter; the adb client concatenates those values into a remote command string that the connected Android device re-parses, executing extra commands as the Android shell user. The issue affects UFO releases prior to 3.0.10 and, per the CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H vector (8.8), requires authentication (PR:L) plus a reachable, already ADB-authorized device, while confining impact to Android shell-user privileges rather than host OS or root execution. No public exploit identified at time of analysis. Vendor-released patch: 3.0.10.
Authenticated command injection in Microsoft UFO's Mobile MCP server (versions prior to 3.0.9) lets a caller who holds a valid UFO_MCP_API_KEY pass shell metacharacters through the press_key tool's free-form key_code parameter and have them executed as the Android shell user on an already-authorized, connected device. Exploitation is remote and requires adb on the UFO host plus a reachable paired device, so it is not a host OS compromise, nor does it grant Android root - impact is bounded to Android shell-user privileges on the target handset. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis; the vendor has released a fix in version 3.0.9, and although the assigned CVSS is 9.1 (Critical), that score is driven largely by the scope change and network vector while the practical blast radius remains capped.
Remote unauthenticated attackers can make ViewSonic vCast fetch and install an attacker-supplied APK by abusing the vCast APK delivery mechanism's unauthenticated download endpoint to point the device at a malicious APK URL. Affected versions are vCast v0.0.0 through v3.2.715 inclusive on ViewSonic ViewBoard devices; the endpoint is network-reachable with no privileges and no user interaction, but the resulting installation is unprivileged, so the planted app runs as a normal application rather than with system/root rights. The supplied CVSS 3.1 base vector is AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5), while our independent assessment treats the practical impact as C:N/I:L/A:N because the outcome is unprivileged app installation; no public exploit identified at time of analysis and no CISA KEV active exploitation is indicated.
Local privilege escalation in the Android Settings component lets an attacker-controlled application that is already running on the device with low privileges (CVSS PR:L, AV:L) abuse a confused-deputy permission check and cause the more-privileged Settings process to perform operations on the caller's behalf, delivering high confidentiality and integrity impact with no user interaction required. Confirmed-affected builds are Android 14, Android 15, Android 16, and Android 16-qpr2, and the only vendor reference provided is the Android Automotive OS security bulletin for 2026-10-01, so the breadth of exposure across Android form factors should be confirmed with Google. There is no public exploit identified at time of analysis, and CISA's SSVC evaluation records exploitation as none, so this is a genuine but second-tier, local-only escalation path rather than a remotely reachable or actively exploited issue.
A permission bypass logic error in Android's DeviceAdminAppsPreferenceController.updateState allows a locally installed, running app to escalate privileges, granting it high confidentiality and integrity impact on affected devices (Android 14, 15, and 16-qpr2). Exploitation requires a local foothold consistent with the assessed CVSS vector (AV:L/PR:L) - the attacker must already have a malicious app executing on the device and be able to reach the device-admin apps preference code path - but no user interaction is needed, so the escalation can occur silently once that app is present. There is no remote attack vector, CISA SSVC records exploitation as 'none' and the flaw as non-automatable (cannot be reliably mass-exploited), and no public exploit code has been identified at time of analysis. This is a credible but not emergency-tier issue.
Local privilege escalation in the Android Settings application (the ApplicationActionButtonsPreferenceController handling app-uninstall controls) allows an attacker who already holds a low-privileged local foothold - such as a malicious or compromised app running in the standard app sandbox - to bypass a permission check and perform actions that should require elevated privileges, with no user interaction required. Affected versions are Android 14, 15, and 16-qpr2, as addressed by the October 2026 Android (Automotive OS) security bulletin; the exploit is only reachable locally (AV:L, PR:L, UI:N) and no public exploit code or active exploitation has been identified at time of analysis. The issue is a logic error in the shouldDisableUninstallButton routine rather than a memory-safety defect, and CISA SSVC rates exploitation as 'none' with 'no' automatable and total technical impact if successfully triggered.
Local privilege escalation in Android 14, 15, 16, 16-qpr2, and 17 allows an attacker with low-level local code execution - such as a pre-installed malicious or compromised app - to bypass permission checks and gain elevated privileges without user interaction, rated CVSS 7.8 (AV:L/PR:L/UI:N). The flaw is a logic error in permission management (CWE-269) tracked as CVE-2026-28625; no public exploit or active exploitation is identified at time of analysis. The only vendor reference is the Android Automotive OS security bulletin, so applicability to general Android handsets should be confirmed.
Remote denial of service in Google Android 14, 15, 16, 16 QPR2, and 17 allows an unauthenticated attacker to crash the device's message-parsing path and cause persistent disruption by sending a crafted MMS/WAP PDU that PduParser.java decodes without an adequate bounds check. Because MMS PDUs are parsed automatically upon receipt, no user interaction or credentials are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5); the only practical precondition is that the attacker can route an MMS to the victim's handset, which normally implies knowing the phone number and having carrier MMS reachability. CISA's SSVC evaluation records exploitation as none with no public exploit identified at time of analysis, although the flaw is classified as automatable, and impact is confined to availability (crash / persistent denial of service) with no confidentiality, integrity, or privilege gain.
Local privilege escalation in Google Android 17 (with a denial-of-service component) allows code running on the device with low-level privileges to trigger an uncaught exception in affected components, yielding high confidentiality, integrity, and availability impact. Per the assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8), exploitation requires a prior local foothold - typically a malicious or compromised third-party application already installed - and needs no user interaction and no additional execution privileges, but cannot be reached remotely over the network; the flaw is scoped to the Android 17 version named in the EUVD data. No public exploit identified at time of analysis.
Local privilege escalation in Google Android 14 through 17 (including 16-qpr2) arises from type-confusion memory corruption in multiple platform locations, letting a process that already has a low-privilege foothold on the device gain high-privilege code execution with confidentiality, integrity, and availability impact. Based on the CVSS vector (AV:L/AC:L/PR:L/UI:N), exploitation requires the attacker to already run code locally in a low-privileged context - a malicious or compromised app in its sandbox - and needs no user interaction and no special configuration; the flaw is reachable in default builds of the affected versions. There is no public exploit identified at time of analysis, CISA SSVC rates exploitation as none and the issue as not automatable, and a vendor-released fix is available through the October 2026 Android Security Bulletin (patch level 2026-10-01), so this is a genuine but not emergency-grade priority - the key limiting factor is the need for an existing on-device foothold rather than remote reachability.
Local privilege escalation in Google Android 14 through 17 (including 16-QPR2) allows a low-privileged app already running on the device to bypass permission checks enforced inside VirtualAudioControllerTest.java and reach elevated functionality, yielding high confidentiality, integrity, and availability impact (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The attack is strictly local: it requires an existing low-privileged execution context on the device, needs no user interaction, and is not remote. No public exploit code has been identified and there is no confirmed active exploitation (CISA KEV) at time of analysis, and CISA's SSVC evaluation rates exploitation as none with the issue judged not automatable.
Heap-based out-of-bounds write in Android's Bluetooth stack, specifically the cfg2prop routine in btif_storage.cc, can be triggered when the Bluetooth subsystem converts attacker-influenced bonded/stored device configuration data into Bluetooth properties, potentially leading to remote code execution. Affected builds are Android 16, Android 16-qpr2, and Android 17; the assessed vector requires low privileges (PR:L, consistent with a pairing/component-level context) and no user interaction, and real-world reachability is expected to be radio-adjacent (a nearby, paired, or spoofed Bluetooth device) rather than arbitrary internet access, even though the vendor-assigned vector carries AV:N. No public exploit code has been identified and SSVC records exploitation as none at time of analysis, but the flaw is memory-corruption class with total technical impact, so it warrants priority patching on devices where Bluetooth is enabled and pairing is common.
Local privilege escalation in Google Android 17 arises from an out-of-bounds write in the stpropnci_process function of stpropnci.cc, where an incorrect bounds check lets a low-privileged local process corrupt memory, with high impact to confidentiality, integrity, and availability (CVSS 3.1 base 7.8, AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the attacker to already have local code execution on the device - an ordinary low-privileged app able to reach the vulnerable function and supply triggering input - after which no additional execution privileges and no user interaction are needed; there is no network-facing or remote trigger, so a foothold must first be obtained or the flaw chained behind a separate remote bug. No public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited (not in CISA KEV), making this a genuine but second-tier priority relative to remotely reachable Android flaws.
Memory corruption in Google Android 16, Android 16-qpr2, and Android 17 lets an attacker who already has low-privilege code executing on the device - for example a malicious or compromised installed app - turn uninitialized-memory handling into an out-of-bounds write and escalate to full privileges with no further execution privileges and no user interaction. The weakness is rated CVSS 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), which requires a pre-existing local foothold rather than a purely network-reachable entry point, and exploitation is only possible on builds that have not applied the 2026-10-01 Android security patch. There is no public exploit identified at time of analysis, CISA's SSVC assessment records Exploitation: none and Automatable: no, so this is a high-priority patch item rather than an emergency, and it is not listed in CISA KEV.
Local privilege escalation in Google Android 14, 15, 16, 16-qpr2, and 17 lets a low-privilege app bypass permission checks through a confused-deputy flaw in the dialInternal code path, allowing the app to perform permission-protected actions it should not be able to perform. Exploitation requires a local foothold - the attacker must already be running code as a low-privilege app (PR:L) - but needs no user interaction (UI:N) and offers no remote attack surface (AV:L), making this a credible but not emergency-priority risk. There is no CISA KEV entry and no public exploit identified at time of analysis; patched builds from the October 2026 Android Security Bulletin are not vulnerable.
Local privilege escalation in Google Android 14, 15, 16, 16 QPR2 and 17 is possible through an out-of-bounds write in the qsort routine of libufdt_sysdeps_vendor.c, which occurs when the device-tree (ufdt) parsing path is driven into resource exhaustion with attacker-influenced input. An attacker who already holds a local, low-privileged foothold on the device - for example a malicious installed app or a process that can feed data into the ufdt parsing path (PR:L) - can trigger the flaw with no user interaction and no additional execution privileges, achieving high confidentiality, integrity and availability impact within the platform (CVSS 7.8). No public exploit identified at time of analysis, and the issue is addressed through the October 2026 Android Security Bulletin.
Local privilege escalation on Android 14, 15, 16, 16-qpr2, and 17 stems from an out-of-bounds read in MessageQueueBase.h caused by an incorrect bounds check, allowing an attacker with low-privilege local code execution to gain elevated privileges with high impact to confidentiality, integrity, and availability (CVSS 7.8). Exploitation requires a locally installed malicious or compromised app and no user interaction, and no public exploit has been identified at the time of analysis.
Local privilege escalation in Android's Bluetooth stack lets an app running with ordinary privileges corrupt control flow in the privileged Bluetooth process and inherit its elevated rights. The root cause is an uninitialized-pointer dereference (CWE-824) in handle_le_monitor_device_event of msft.cc, the Microsoft HCI vendor-extension handler, affecting Android 16, Android 16-qpr2 and Android 17 per EUVD. This is a second-stage escalation rather than a remote entry point: the attacker must already have local code execution and be able to reach the Bluetooth LE monitoring path (CVSS AV:L, PR:L, UI:N), and no public exploit code has been identified at time of analysis; Google addresses the issue in its October 2026 Android Security Bulletin.
Local privilege escalation in Google Android 14 through 17 (including 16 QPR2) lets a low-privilege local actor trigger an integer overflow inside the NFC Type 4 Tag read/write path (rw_t4t_update_file in rw_t4t.cc) that produces an out-of-bounds write, yielding code execution in a higher-privileged context. Per the assessed vector (AV:L/AC:L/PR:L/UI:N), the attacker must already have local code execution or app presence on the device but needs no user interaction, and exploitation requires attacker-controlled NFC Type 4 Tag data to reach the reader/writer code path on an unpatched build. There is no public exploit identified at time of analysis and no confirmed active exploitation (not in CISA KEV); the CVSS score is 7.8 and the practical constraint is the local-only attack vector, making this a genuine fleet-patching priority rather than an emergency.
An out-of-bounds write in Android's NFC Execution Environment (NFCEE) action handling code (nfa_nfcee_act.cc) lets a locally installed low-privilege application corrupt memory in the NFC stack and escalate to system-level privileges. Per the assessed CVSS:3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, the attacker must already be able to run code on the device as a low-privilege app (PR:L) and the flaw is not reachable over the network (AV:L), with no user interaction required; devices running unpatched Android 16, 16-qpr2, or 17 builds are affected, while those with the October 2026 security patch are not. Exploitation is not observed in the field - SSVC records Exploitation:none and there is no KEV listing or public exploit code identified at time of analysis - and EPSS is low at 0.11% (1st percentile), so this presents as a genuine but non-urgent local privilege-escalation issue rather than a remotely exploitable emergency.
An out-of-bounds write in Android's wpa_supplicant Robust AV / SCS action-frame handler (wpas_handle_robust_av_scs_recv_action in robust_av.c) can be turned into remote code execution on Android 14 through 17 (including 16-qpr2) devices that receive a crafted SCS action frame. Exploitation is sharply constrained: per the CVSS vector PR:H, the attacker must already hold System-level execution privileges on the target before the malformed frame is processed, and the independently assessed vector (AV:A) places the attacker in Wi-Fi/adjacent range rather than on arbitrary internet-routable paths. User interaction is not required (UI:N), and no public exploit code or CISA KEV entry has been identified at time of analysis; combined with the vendor score of 7.2 and the adjacent-vector reassessment, this rates as a moderate, not emergency, priority.
Local privilege escalation in Google Android 17 lets a locally installed, low-privileged application escape its sandbox and obtain system-level privileges by reaching the isSystem() routine in WifiPermissionsUtil.java, which fails to perform the required permission check (CWE-862). The flaw is rated CVSS 8.8 (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), reflecting a changed-scope impact in which a compromised app in the application sandbox compromises the platform itself, with high confidentiality, integrity and availability effects and no user interaction required. An attacker must already have achieved local code execution on the device (for example through a malicious or trojanized app), and only Android 17 is listed as affected, so devices on other releases or on the October 2026 patch level are not exposed; no public exploit identified at time of analysis, and the issue is addressed through the Android Security Bulletin dated 2026-10-01.
Local privilege escalation in MediaTek NeuroPilot on affected chipsets (MT8781, MT8189, MT6993, MT8793, MT8910, MT8668, MT8188, MT6881, MT8875) allows an attacker with local code execution to trigger an out-of-bounds write in the APU/AI driver, potentially gaining high-integrity code execution with no user interaction, though no additional privileges are needed once that local app context exists. Vendor patch ALPS11249062 is available; no public exploit identified at time of analysis. It is a high-priority patch target for affected MediaTek-based devices but is not remotely reachable, limiting its scope to privilege escalation rather than initial compromise.
Local privilege escalation in MediaTek's Video HAL lets an unprivileged app already running on an affected device corrupt a fixed-size stack buffer via crafted input to the video hardware abstraction layer, yielding code execution in the HAL context with high impact to confidentiality, integrity and availability (CVSS 8.4, AV:L/PR:N/UI:N). The flaw stems from a missing bounds check (CWE-121, stack-based buffer overflow) and affects roughly four dozen MediaTek chipsets spanning the MT6xxx, MT8xxx and MT2718 families used in Android phones, tablets, Chromebooks and automotive platforms. No user interaction and no additional execution privileges are required once local code execution exists, but the attack vector is local only - remote exploitation is not indicated and no public exploit code has been identified at time of analysis. MediaTek has assigned patch ID ALPS11375674 (issue MSV-9571), delivered to OEMs through its October 2026 product security bulletin.
A hardcoded API key ships inside the GeoVision GV-Eye Android application (V3.6.0) and can be recovered by reverse engineering the publicly distributed APK, allowing anyone who extracts it to invoke whatever GeoVision backend API operations that key authorizes. The impact is confidentiality-only (C:H, I:N, A:N) scoped to a single embedded credential, and the independent assessment scores it as a local-vector issue (AV:L) because the attacker must first obtain and analyze the client package. No public exploit code identified at time of analysis, and the CVE is not listed in CISA KEV; the practical damage ceiling depends on whether GeoVision rotates or revokes the leaked key on the server side.
Hardcoded API key exposure in the GeoVision GV-Eye Android application (V3.6.0) allows unauthenticated remote attackers to extract the key from the publicly distributable APK via reverse engineering and use it to access backend or third-party services, resulting in high confidentiality impact. With a CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) and CWE-798 classification, the vulnerability requires no user interaction or special privileges, though the actual blast radius is limited by the permissions associated with the single exposed key. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated extraction of permanent, plaintext cloud storage credentials from the Viidure Android dashcam companion application (CVE-2026-96587) gives any party who obtains the publicly distributed APK full read, write, and delete access to backend object storage holding operational files such as firmware and application binaries. Because the credentials are hardcoded in the shipped artifact and the assessed vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, exploitation requires only network reachability to the storage endpoint plus routine decompilation of the app package - no victim interaction, authentication, or non-default configuration is needed. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the practical limiter is the niche install base of this consumer dashcam app rather than any technical barrier; the independent assessment nevertheless flags this as a genuine high-priority finding because the exposure is architectural (server-side credential revocation is the only real containment) and write/delete scope against firmware could enable tampering with the update channel if the recovered keys retain that privilege.
Sandbox escape in Google Chrome's WebView component on Android (versions prior to 154.0.8037.92) lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by serving a crafted HTML page to the victim. The flaw is a second-stage, chain-completing bug rather than a standalone remote-compromise vector: it requires an existing renderer-level foothold, high attack complexity, and victim user interaction, which is why CISA's SSVC assessment marks exploitation as 'none', automatability as 'no', and Chromium rates its own security severity as Low despite a 7.5 CVSS base score. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; a vendor patch is available in Chrome 154.0.8037.92.
Remote code execution is possible in Google Chrome on Android builds prior to 154.0.8037.92, where a heap-based buffer overflow in the ANGLE graphics layer can be triggered when a user renders a crafted HTML page. Successful exploitation corrupts memory out of bounds and, per Google's Critical severity rating and the scope-changed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), can potentially execute arbitrary code outside the browser sandbox. The issue is remotely deliverable without authentication but hinges on user interaction, and no public exploit code or active exploitation has been identified at time of analysis; CISA's SSVC assessment likewise records no observed exploitation and rates the flaw non-automatable, while a vendor patch (154.0.8037.92) is available.
Command injection in Root Browser Classic 3.3.0 (Android, package com.jrummyapps.rootbrowser.classic) lets an attacker execute arbitrary shell commands with the app's privileges by supplying a SQLite database whose filename is seeded with shell metacharacters; the app passes that path to an operating-system shell without separating the filename from the command (CWE-78). Exploitation is local rather than remote: the crafted file must first reach the device (download, sideload, shared storage or another app) and the victim must then open it inside the app, so the flaw is gated by passive user interaction and confined to users of this root-capable file manager. No public exploit code was identified at time of analysis, and while exploitation yields high confidentiality, integrity and availability impact, the 8.5 CVSS v4.0 base score overstates the practical exposure because the realistic attack surface is narrow.
UI spoofing in Arc Search for Android before 1.12.10 lets an unauthenticated remote attacker use a crafted webpage that enters fullscreen while the app is backgrounded to suppress the return-from-background fullscreen notification and render fake browser UI, such as a spoofed address bar. The victim must visit the attacker-controlled page and be deceived by the spoofed origin, so exploitation requires user interaction and carries no confidentiality or availability impact, though integrity impact is high for phishing. No CISA KEV listing or public exploit code was identified at time of analysis; CVSS 3.1 base score is 7.4 (AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N).
Stored cross-site scripting (XSS) in Adobe Connect and the Adobe Connect Android mobile app lets an attacker plant malicious JavaScript inside a vulnerable form field, which then executes in the browser of any user who later browses to the page rendering that field - enabling session or account takeover inside the victim's browser context. Adobe rates the flaw 9.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N), while independent analysis assesses it more conservatively as CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, because the injection step realistically requires prior authenticated content-submission or authoring access and a victim must still be drawn to the affected page; impact is bounded by the victim's browser session rather than direct server compromise. There is no public exploit identified at time of analysis, and the issue is not confirmed actively exploited (CISA KEV).
DesktopSMS 1.11.0 (MrPear) exposes a local/loopback service that performs privileged SMS operations - sending messages, returning SMS-derived content, and persisting a paired identity - without any pairing confirmation, authentication, or user interaction, so any process already running on the same device can exercise the victim app's SMS permissions. Exploitation is strictly local: an attacker must first have code execution on the device (a co-installed malicious app, or ADB/loopback access), which is why the assessed vector is AV:L with PR:N and UI:N but a hard device-foothold prerequisite. Publicly available exploit code exists (a proof-of-concept client has been published), and while no confirmed active exploitation is recorded, the low complexity and absence of user interaction make this a practical post-foothold privilege-escalation primitive against the app's SMS capabilities.
Command injection within Acode on Android lets any locally installed application execute arbitrary shell commands inside Acode's own sandboxed UID, exposing private app data, stored remote credentials, Storage Access Framework grants and granted runtime permissions. The flaw affects builds from 1.11.6 up to but not including 1.12.7, where the terminal plugin exports com.foxdebug.acode.rk.exec.terminal.TerminalService without a binding permission and TerminalService.java performs no caller verification, so a zero-permission hostile app can bind the service and pass an attacker-controlled cmd value via MSG_EXEC. Exploitation is strictly local and requires the victim to already have run a malicious app alongside a vulnerable Acode release; no public exploit code has been identified at time of analysis and there is no CISA KEV listing or EPSS signal reported.
Use-after-free in the Dawn (WebGPU) component of Google Chrome on Android before 153.0.8010.52 allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim renders a crafted HTML page. Exploitation requires the user to load attacker-controlled content (CVSS 9.6, AV:N/AC:L/PR:N/UI:R), and Google rates the bug Chromium security severity Critical; the only affected configuration is Chrome on Android below the fixed 153.0.8010.52 build, and devices already updated are not exposed. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by the size of the unpatched Android install base rather than by observed attacks.
Remote code execution outside the browser sandbox in Google Chrome on Android prior to 153.0.8010.52 is possible when a victim opens a crafted HTML page containing malicious WebGL content that triggers a stack-based buffer overflow. Unauthenticated remote attackers can achieve code execution in the context of the GPU/renderer process with high impact to confidentiality, integrity, and availability, though exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6, Chromium security severity Critical). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Google has released a fixed build (153.0.8010.52) and the flaw is tracked as EUVD-2026-82476 and VulDB 407131.
Improper input validation in multiple locations of the Android kernel allows a locally installed application to escalate privileges on affected Pixel and Android devices, with no additional execution privileges or user interaction required. The flaw is rated 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting a local attacker who already holds low-privileged code execution but can reach high-integrity kernel operations. It is addressed in the September 2026 Android/Pixel security bulletin; at time of analysis there is no CISA KEV listing, no confirmed public exploit code, and no EPSS signal was supplied with the source data.
An out-of-bounds read in the Android hardware VP9 decode path (Vp9DecEndOfStream in vp9hwd_output.cc) permits a locally installed app that can feed a crafted VP9 bitstream to the platform decoder to read memory beyond the intended buffer, leaking process data. Exploitation requires a local foothold (AV:L) - an app already running on the device - but no additional privileges (PR:N) and no user interaction (UI:N); the flaw is confined to devices using Google/Tensor's hardware VP9 decode implementation and is not remotely exploitable. Independent reassessment of the impact narrows this to information disclosure (C:H/I:N/A:L) rather than the vendor's code-execution framing, and no public exploit code or confirmed active exploitation was identified at time of analysis; EPSS is 0.11% (2nd percentile), indicating very low predicted real-world exploitation activity.
Local privilege escalation in the Pixel-specific kernel PHY power driver, specifically the gmc_phy_lp3_exit_restore_registers routine in phy_power.c, where a missing bounds check permits an out-of-bounds memory write (CWE-120). Reaching the vulnerable code path requires code already executing at Android System privilege level on an affected Pixel device, and no user interaction is needed once that context is held; per the assessed vector (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) this is an authenticated/high-privilege local issue rather than an unprivileged-app primitive, making it most useful as a later stage in an exploit chain. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor fix is available through the September 2026 Pixel security bulletin.
Local privilege escalation in the Android kernel's FsmReleaseKey routine allows a malicious or compromised app already running on a Pixel device to bypass permission checks and gain kernel-level access, affecting confidentiality, integrity, and availability. Exploitation requires no credentials, no elevated privileges, and no user interaction (CVSS 8.4, AV:L/PR:N/UI:N), so any unpatched build predating the 2026-09-01 Pixel security patch level is exposed. No public exploit identified at time of analysis and EPSS is low at 0.12% (2nd percentile), so this is a genuine but non-urgent patching priority rather than an active threat.
Local privilege escalation in Google Android allows an unprivileged app already running on the device to trigger a heap buffer overflow in the gf_ta_test_set_config routine of gf_ta_test.c, potentially gaining elevated code execution within the affected component. The flaw carries CVSS 8.4 (AV:L/AC:L/PR:N/UI:N, C/I/A High), requires on-device execution but no elevated privileges or user interaction, and affects Android builds where the vulnerable fingerprint/trusted-application test/config code is present. EPSS is very low at 0.12% (2nd percentile), no public exploit identified at time of analysis, and the issue is fixed in the 2026-09-01 Pixel security patch level.
Privilege escalation in the Android Bootloader allows a local attacker who already holds System execution privileges to bypass an intended permission check and obtain higher-privileged code execution on affected devices. The root cause is a logic error in bootloader permission enforcement (CWE-693, protection mechanism failure) that requires no user interaction and is reachable only through local access, making it a privilege-escalation link inside a larger exploit chain rather than a standalone remote threat; the affected scope appears limited to Google Pixel devices addressed by the 2026-09-01 Pixel security bulletin. No public exploit code and no confirmed active exploitation were identified at time of analysis, and no EPSS data accompanied the available reporting.
Privilege escalation in the Android Setup Wizard (Google Android, fixed in the September 2026 Pixel bulletin) lets a locally-running, low-privilege app trigger a package installation because the Setup Wizard's install code path performs a missing permission check. Per the assessed vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, exploitation requires code already executing on the device under a low-privileged context, needs no user interaction and no additional execution privileges, and yields high confidentiality and integrity impact in a local attack. Despite the advisory's 'remote package install' phrasing, the CVSS vector confirms this is not a network-reachable attack, and no public exploit has been identified at time of analysis.
Improper input validation in the Android modem/baseband allows an attacker who can deliver crafted radio-layer signaling to the device to cause information disclosure, scored 7.5 (HIGH) under CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The affected component is the cellular modem in Google Android, reported by Google Devices and published in the Pixel security bulletin dated 2026-09-01 (EUVD-2026-78991); default configurations are exposed once the handset attaches to an attacker-controlled radio environment, and no on-device privileges or user interaction are required. Although the vector is network-rated, practical exploitation requires RF proximity and specialized SDR/IMSI-catcher-class hardware rather than arbitrary internet reachability, and impact is confined to confidentiality with no code execution or integrity/availability effect. Risk is tempered by the absence of confirmed active exploitation and an EPSS score of only 0.24% (15th percentile), so no public exploit was identified at the time of analysis.
Local privilege escalation in Google Android affects Pixel builds addressed by the 2026-09-01 Android/Pixel security bulletin, where an unprivileged app already running on the device can trigger an out-of-bounds read caused by type confusion and potentially gain elevated code execution. The issue is locally reachable with no user interaction and no prior privileges (CVSS:3.1/AV:L/AC:L/PR:N/UI:N), but an attacker must first get malicious code onto the device, so exposure is largely limited to users who sideload apps or run compromised applications. There is no CISA KEV listing and no public exploit code identified at time of analysis, and exploitation risk is low per EPSS at 0.11% (2nd percentile). The flaw was reported by Google Devices and tracked in the EU as EUVD-2026-78985.
Local privilege escalation in Google Android and Pixel builds lets an already-installed, unprivileged app leverage a type-confusion flaw in multiple system files to obtain signature data it should not be able to reach, escalating to a higher-privileged context. The attack is purely local: per the CVSS vector (AV:L/PR:N/UI:N) no credentials, elevated privileges, or user interaction are required beyond getting a malicious app running on the device, though the attacker must first sideload or distribute that app through a store listing. Exploitation is not confirmed as active, no public exploit code has been identified, and the EPSS score is very low (0.11%, 2nd percentile), making this a genuine but moderate-priority local privilege-escalation issue rather than a mass-exploitation threat; vendor patches are addressed in the 2026-09-01 Pixel security bulletin.
Local privilege escalation in the Android VPU (Video Processing Unit) component lets an attacker who already holds low-privilege code execution - such as a malicious or compromised app running on the device - bypass a missing permission check and elevate to System-level execution privileges, with no user interaction required. The flaw is assessed at CVSS 7.8 (AV:L/AC:L/PR:L/UI:N) and was reported by Google Devices against the Pixel security bulletin, so real-world exposure centers on Pixel hardware that exposes the affected VPU subsystem rather than all devices matching the broad google:android CPE. EPSS is only 0.12% (2nd percentile) and no public exploit identified at time of analysis; impact is bounded to System privileges, not full kernel or root.
Out-of-bounds read in the Android kernel's configuration accessor get_global_config_item_addr() in gc.c allows a local attacker to read memory past the end of an allocation because the routine never validates the requested item index against the bounds of the config region. Google assigns the issue High severity (CVSS 8.4, vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting that it can be reached with no additional execution privileges and no user interaction and can be leveraged toward local escalation of privilege on the affected device. Current intelligence does not indicate active exploitation: EPSS is only 0.11% (2nd percentile), no public exploit code has been identified at time of analysis, and the CVE is not in CISA KEV; fixes shipped in the September 2026 Android/Pixel security bulletin (2026-09-01), making this a genuine but not urgent local privilege-escalation issue.
Local privilege escalation in the Android kernel allows an unprivileged app already running on a Pixel or other affected Android device to bypass a missing permission check and gain elevated privileges, resulting in full compromise of confidentiality, integrity, and availability (CVSS 8.4, AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). Because the vector is local-only and requires the attacker to already execute code on the device, the exposure is limited to post-compromise or malicious-app scenarios rather than remote attacks, and no user interaction is needed once that foothold exists. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV not applicable); EPSS is low at 0.12% (2nd percentile), and the September 2026 Android/Pixel security patch level (2026-09-01) contains the fix. Vendor-assigned severity is High, driven by the complete loss of C/I/A from a low-privilege starting point.
A heap-based buffer overflow (out-of-bounds write) exists in the Android Cellular Modem component, allowing an attacker within adjacent/proximal radio range to corrupt heap memory and potentially execute code in the modem context without user interaction. The flaw carries a CVSS base score of 8.0 (AV:A/AC:L/PR:L/UI:N) and affects Google Android devices per the Android/Google Devices CPE. No public exploit code or CISA KEV listing was provided at time of analysis, so exploitation status is unconfirmed; the vendor fix is documented in the September 2026 Pixel/Android Security Bulletin.
Use-after-free (CWE-416) in the Android kernel allows a remote attacker to escalate privileges to kernel level on affected Pixel and Android devices, with no authentication, no user interaction, and no additional execution privileges required per the CVSS vector. Google rates this 9.8 (AV:N/AC:L/PR:N/UI:N) in its September 2026 Pixel security bulletin, while independent assessment lowers the practical rating to 8.1 (AC:H) because successful exploitation must first reach the vulnerable kernel code path and then defeat Android kernel memory-corruption mitigations such as KASLR, allocator hardening, and CFI. EPSS is only 0.16% (5th percentile) and there is no CISA KEV entry and no public exploit identified at time of analysis, so exploitation is currently considered possible but not observed.
Local privilege escalation in Google Android's fingerprint TEE HAL allows an unprivileged app already running on an affected Pixel/Android device to trigger a use-after-free in fpc_tee_hal.c and gain elevated code execution. Exploitation requires local code execution as a prerequisite, no user interaction, and no additional execution privileges; it is not remotely triggerable. No public exploit code has been identified at time of analysis, and EPSS is 0.12% (2nd percentile), indicating low predicted exploitation activity despite the 8.4 CVSS score. Devices are affected if they include the Fingerprint Cards TEE HAL and have not been updated to the 2026-09-01 Android/Pixel security patch level.
Local privilege escalation in the Android kernel affecting Google/Pixel devices lets an unprivileged app already running on the device trigger a use-after-free and gain elevated privileges. The flaw stems from improper locking in a kernel code path (CWE-416), and no user interaction is required; however, an attacker must first have local code execution on the device and must win a locking race to corrupt kernel memory, which adds real-world reliability constraints. No public exploit code has been identified at time of analysis, the issue is not listed in CISA KEV, and EPSS is low at 0.11% (2nd percentile), so this is a genuine but not urgent local privilege-escalation issue confined to devices running kernel builds older than the 2026-09-01 patch level.
Local privilege escalation in the Android kernel's remap.c enable_segment path allows an unprivileged app to bypass segment permissions and gain elevated privileges on affected Pixel and Android devices (CVSS 8.4, High). Exploitation requires only an app-level foothold with no user interaction, and no public exploit code has been identified at time of analysis; EPSS is low at 0.13% (3rd percentile). Devices at a pre-2026-09-01 patch level remain at risk and are fixed by the Android Security Bulletin dated 2026-09-01.
Authentication bypass in Android's IP Multimedia Subsystem (IMS) telephony stack lets an attacker who can reach a device's IMS/SIP signaling path escalate privileges remotely, with no user interaction and no prior authentication required per the vendor vector (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw is a logic error (CWE-693, Protection Mechanism Failure) affecting unpatched Android builds - the CPE entry covers all Android versions until the 2026-09-01 security patch level is applied. Exploitation in practice most plausibly requires an adjacent or carrier-network foothold, such as a compromised or malicious IMS core or a rogue base station, because the vulnerable path is the telephony signaling channel rather than an arbitrary Internet-facing service; no public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low (0.20%, 10th percentile), so the high severity stems from the potential impact if reachable rather than from observed exploitation.
Out-of-bounds write in Android's IMS media audio decoder (decodeAmr() in ImsMediaAudioPlayer.cpp) lets a remote party in an IMS-based media session - such as a VoLTE or VoWiFi call carrying crafted AMR-encoded audio - corrupt memory and potentially achieve remote code execution on the device. Affected are Android devices with an active IMS media stack (CPE cpe:2.3:a:google:android:*), and exploitation requires user interaction because the victim must answer or join the call/media session, which significantly limits mass exploitation. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis, and the EPSS score is low (0.21%, 12th percentile), so this is best treated as a serious but currently latent memory-corruption risk pending the September 2026 Android/Pixel security bulletin fix.
Denial of service in the cellular modem of Google Android devices allows a radio-adjacent attacker to disrupt or crash baseband connectivity by sending crafted, malformed signaling input over the radio interface. The flaw is an improper input validation issue (CWE-20) rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), meaning no authentication or user interaction is required once the attacker has radio reach, though exploitation requires a rogue or compromised base station, IMSI-catcher, or signaling injection capability within RF range of an active cellular connection. No public exploit identified at time of analysis, and EPSS is 0.25% (16th percentile), indicating a low predicted likelihood of exploitation; impact is limited to availability (recoverable modem/connectivity denial of service) with no confidentiality, integrity, code execution, or persistence impact.
An out-of-bounds write in the Wave6 VPU video-decoder driver (Wave6VpuDecFlush in wave6.c) lets an unprivileged local app corrupt kernel memory on affected Android devices, escalating to kernel-level privilege and full device compromise. The flaw requires local code execution - an attacker must already be able to run code on the device and reach the decoder's flush routine - but needs no user interaction and no prior elevated privileges (AV:L, PR:N, UI:N). It is not known to be actively exploited, has no identified public exploit code at time of analysis, and carries a low EPSS score of 0.11% (2nd percentile), making it a serious but locally-scoped privilege-escalation issue rather than an internet-facing emergency.
Local privilege escalation in the Android kernel (CVE-2026-0194) arises from an integer overflow that enables a permission bypass, allowing code already running on a device to elevate its privileges. The issue is local in scope: the assessed vector is AV:L/PR:L, meaning an attacker must first be able to execute code on the handset - for example through an installed malicious or compromised app - after which the overflow can be triggered with no user interaction and, per the description, no additional execution privileges. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; EPSS is low at roughly 0.12 percent (2nd percentile), and remediation is delivered through the September 2026 Pixel/Android security bulletin.
Local privilege escalation in Google Android's init process allows an unprivileged local app to bypass an access-control policy and gain elevated privileges on affected Android/Pixel builds. The root cause is a logic error in the ac_init_policy routine in init.c, tracked as CWE-693 (protection mechanism failure), and the vendor scores it 8.4 with vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - no user interaction, no privileges required (PR:N), and no non-default configuration needed, though the attack is strictly local and requires the attacker to first get code running on the device. No public exploit code has been identified at time of analysis and EPSS is low (0.13%, 3rd percentile), so active exploitation is not confirmed; a fix is covered by the September 2026 Android/Pixel security bulletin.
Sensitive health-data exposure in the Lenovo Health Android application (distributed exclusively in the Chinese market) stems from hardcoded credentials (CWE-798) that let an attacker access users' health-related information without legitimate authentication. Reported by Lenovo PSIRT and tracked under a single Lenovo advisory, it carries a CVSS 4.0 base of 9.3 driven by high confidentiality impact. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV.
Improper export of Android application components in Lenovo File Manager (Chinese-market distribution) enables a locally authenticated user or co-installed application to read or modify files that the application designates as protected. The root cause is CWE-926, where one or more Android components - likely a content provider or activity - are exported without enforcing the application's own authorization logic. No public exploit code exists and the vulnerability has not been added to CISA KEV; however, the CVSS 4.0 score of 8.4 reflects genuine high-impact file access if an attacker can install a companion malicious application on the target device.
Out-of-bounds write in libmdnie.so on Samsung Mobile Devices running Android 15, 16, and 17 enables local attackers to execute arbitrary code with system server privilege. The flaw resides in Samsung's proprietary Mobile Display Image Enhancement (mdnie) library, which is accessible from low-privilege application contexts with no special Android permissions required. No public exploit has been identified at time of analysis, and Samsung addressed this in the September 2026 Monthly Security Release (SMR Sep-2026 Release 1).