Android
Monthly
Missing authorization in the WebView component of Google Chrome on Android before 153.0.8010.36 lets a remote attacker who first tricks a user via social engineering bypass system access restrictions through crafted network traffic. The flaw is tracked as CWE-862 (missing authorization) and was reported by Google's Chrome team; a vendor patch is available. Chromium rates the security severity as Medium, EPSS is low (0.17%), and no public exploit or CISA KEV listing has been identified.
Local privilege escalation in the Android kernel's IOMMU subsystem (iommu.c) allows any process with basic user-level execution to gain full kernel privileges through out-of-bounds memory read/write triggered by improper input validation across multiple functions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required, making this a reliable local privilege escalation primitive for post-compromise chains or malicious apps. Google patched this in the Android Security Bulletin for September 2026 with two upstream kernel commits; no public exploit has been identified at time of analysis.
Local privilege escalation in Android's MountRegistry component across Android 14, 15, 16, and 16-qpr2 allows a low-privileged process to achieve full device compromise via a buffer overflow in the forEachLine function of MountRegistry.cpp. The flaw triggers an out-of-bounds read that can corrupt adjacent memory, enabling an attacker to elevate from a sandboxed app or low-privilege process to a higher system privilege level without any user interaction. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total.
Remote code execution in Android (versions 14 through 17) arises from improper type casting in multiple functions of ftsmooth.c, the anti-aliased smooth rasterizer of the bundled FreeType font-rendering engine. An attacker can trigger memory corruption through a maliciously crafted font with no user interaction and no additional execution privileges, per the September 2026 Android Security Bulletin. There is no public exploit identified at time of analysis; CISA SSVC lists exploitation status as none but rates the flaw automatable with total technical impact.
Out-of-bounds write in Android's NFC RoutingManager (checkUikcListenConfigNeeded in RoutingManager.cpp) enables remote code execution from adjacent NFC proximity on Android 16-QPR2 and Android 17 without requiring user interaction. The missing bounds check in UICC listen configuration handling allows a proximal attacker to corrupt memory in the NFC daemon, leading to full code execution in that process context. No public exploit has been identified at time of analysis; SSVC rates technical impact as total but exploitation status as none.
Local privilege escalation in Android 16, 16-QPR2, and 17 stems from improper input validation in the AppendCommentLine function of AnnotationProcessor.cpp. A low-privileged local attacker can exploit this CWE-20 flaw without user interaction to achieve full confidentiality, integrity, and availability impact, consistent with a complete privilege escalation on the device. Google's Android Security Bulletin for September 2026 (2026-09-01) addresses this issue; the description's explicit 'supply chain risk' framing is atypical and suggests the vulnerable code participates in a build or annotation-processing pipeline where malicious input could propagate into compiled artifacts.
Remote code execution in Google Android (versions 14 through 17, including 16-qpr2) arises from a heap buffer overflow (CWE-122) present in multiple system code paths, per the September 2026 Android Security Bulletin. The flaw is reported by Google's Android security team as exploitable with no additional execution privileges and no user interaction, giving a remote attacker full compromise of the affected process context. SSVC rates exploitation as 'none' and there is no public exploit identified at time of analysis, but CISA's automatable=yes / technical-impact=total assessment marks it as a high-priority patch target.
Integer overflow in FreeType's COLR color-layer blending function (tt_face_colr_blend_layer in ttcolr.c) enables local privilege escalation across Android 14 through 17. A low-privileged app can deliver a maliciously crafted TrueType font containing a corrupted COLR table, triggering arithmetic overflow that corrupts heap memory and enables code execution in a higher-privileged system context. No active exploitation has been identified (EPSS 0.15%, SSVC Exploitation: none), and no user interaction beyond app execution is required.
Remote code execution is achievable in Android's NFC subsystem across Android 14 through 17, including Android 16-QPR2, via a heap buffer overflow in the MIFARE Classic tag reader function rw_mfc_handle_read_op() within rw_mfc.cc. An attacker within NFC proximity can present a crafted MIFARE Classic tag that overflows a heap-allocated buffer in the NFC daemon, yielding full device control with no victim interaction required and no privileges needed on the target. No public exploit has been identified at time of analysis, though the SSVC framework rates the technical impact as total given the unauthenticated RCE capability.
Remote code execution is possible in Android's NFC Type 3 Tag processing layer (rw_t3t.cc within libnfc-nci) across Android 14 through 17 via an integer overflow that triggers a heap out-of-bounds write. No user interaction or additional privileges are required per the description, making this exploitable by any attacker within NFC proximity of an unpatched device. Google addressed this in the September 2026 Android Security Bulletin; no public exploit or active exploitation has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation status as 'none'.
Heap buffer overflow in the `read_boot_region` function of Android's filesystem check utility (`fsck.c`) allows a local, low-privileged process to escalate privileges with full system impact. The flaw spans Android 14 through 17 (including QPR2 branches) and was disclosed in Google's September 2026 Android Security Bulletin. No public exploit code has been identified at time of analysis, and EPSS signals a very low current exploitation probability.
Local privilege escalation in Android's StorageManagerService (Android 14 through 17) stems from an unsafe PendingIntent in getManageSpaceActivityIntent that enables a LaunchAnyWhere attack chain, allowing a malicious low-privilege app to intercept and redirect activity launches into privileged system contexts. The vulnerability requires user interaction - specifically navigating the storage management UI - but once triggered, yields full compromise of confidentiality, integrity, and availability on the device. No public exploit has been identified at time of analysis; Google's September 2026 Android Security Bulletin documents the fix.
Heap buffer overflow in Android's Bluetooth A2DP Opus vendor codec decoder allows a local low-privileged attacker to escalate privileges with no user interaction required. The flaw resides in `a2dp_vendor_opus_decoder_decode_packet` within `a2dp_vendor_opus_decoder.cc`, where a crafted Opus-encoded audio stream can trigger an out-of-bounds write on the heap. Affected versions span Android 14 through Android 17; no public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none.
Local privilege escalation in Android's runtime image writer (WriteImageToDisk, runtime_image.cc) allows a low-privileged local process to tamper with files through a logic error, potentially gaining full system control. Affected versions span Android 14 through Android 17, including the Android 16-QPR2 branch, making this a broad-impact flaw across the current and future Android release train. No public exploit has been identified at time of analysis, and SSVC indicates exploitation is currently none, but the Technical Impact rating of 'total' underscores the severity if exploited.
Background Activity Launch (BAL) bypass in Android's LauncherAppsService allows a low-privilege local application to launch foreground activities from the background without user awareness or interaction. The flaw resides in `buildIntentSenderForUser` within `LauncherAppsService.java`, where authorization checks (CWE-863) are insufficient to prevent background callers from obtaining a valid intent sender that sidesteps Android's BAL restrictions. Affected versions include Android 16, Android 16-QPR2, and Android 17; no public exploit identified at time of analysis.
Factory Reset Protection (FRP) in Android 14 through 17 can be bypassed via a logic error in `findMetaAuthUid` within `AccountsDb.java`, allowing a local attacker with minimal privileges to gain full control of a device without additional permissions or any victim interaction. All currently supported Android major versions are confirmed affected per Google's September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, though the total CIA impact (C:H/I:H/A:H) means successful exploitation yields complete device compromise.
Local privilege escalation in Android's AppWidgetConfigActivityProxy allows a low-privileged installed application to illicitly obtain URI permissions through a confused deputy flaw in the onActivityResult handler of AppWidgetConfigActivityProxy.java. Affected versions are Android 16-QPR2 and Android 17; the September 2026 Android Security Bulletin provides the fix. No public exploit code or active exploitation (KEV) has been identified; EPSS at 0.12% and SSVC 'Exploitation: none' confirm low observed activity, though SSVC rates the technical impact as total.
Local privilege escalation in Android's NFC Type 3 Tag (T3T) reader/writer component affects Android 14 through 17, including the Android 16 QPR2 branch. Multiple functions in rw_t3t.cc contain an integer overflow that leads to an out-of-bounds write, enabling a low-privileged local process to gain full system-level access without any user interaction. No public exploit code has been identified at time of analysis, and the EPSS score of 0.11% places this in the 2nd percentile for near-term exploitation probability.
Local privilege escalation in Android's Window Manager Service (WindowState.java) allows a low-privileged app to bypass overlay protection mechanisms across Android versions 14 through 17. The logic error in setHiddenWhileSuspended permits unauthorized overlay windows to remain visible or interact with the display even when they should be hidden for suspended apps, creating a pathway to full CIA compromise on the device. No public exploit has been identified at time of analysis, and EPSS scores the exploitation probability at just 0.13% (3rd percentile), though SSVC rates technical impact as total.
Local privilege escalation in Android 14 through 16 allows a low-privileged application to gain full system-level access by exploiting a confused deputy flaw in the ActivityTaskManagerService. The vulnerability exists in the startNextMatchingActivity method of ActivityTaskManagerService.java, where the service can be manipulated into exercising its elevated permissions on behalf of an unprivileged caller, bypassing Android's permission model. No additional execution privileges or user interaction are required, and no public exploit has been identified at time of analysis.
Local privilege escalation in Android's telephony stack allows a low-privilege app to send USSD requests without the required telephony permission, bypassing Android's permission model through a logic error in handleUssdRequest of PhoneInterfaceManager.java. Affected releases span Android 14 through 17 including the 16-QPR2 branch, with no user interaction required post-installation. USSD access can reach carrier-side services capable of triggering sensitive device operations, making a successful exploit a pathway to full device compromise.
Privilege escalation in Android's cross-profile intent-forwarding mechanism (IntentForwarderActivity.java) allows a locally installed low-privilege application to bypass the user consent dialog presented by buildMiniResolver via a tapjacking or overlay attack, achieving full confidentiality, integrity, and availability impact across Android 14 through 17 including the QPR2 train. The vendor explicitly states no user interaction is required, indicating the consent bypass is mechanically triggered against the framework rather than requiring the victim to tap attacker-crafted UI. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.12% (2nd percentile) and SSVC Automatable=no confirm no observed mass exploitation.
Intent redirection in Android's SetupPassthroughActivity allows a locally present, low-privilege attacker to launch arbitrary activities and escalate privileges to a higher-trust system level. Affecting Android 14 through 17 (including 16-qpr2), the flaw resides in the onCreate method of SetupPassthroughActivity.java and requires user interaction to trigger. No public exploit is identified at time of analysis, and an EPSS of 0.11% (2nd percentile) indicates minimal current exploitation probability, consistent with the SSVC exploitation-none signal.
Local privilege escalation in Android 16 and 17 exploits a confused deputy (CWE-441) vulnerability present across multiple system locations, allowing a low-privileged local process to read and write files it is not authorized to access. An attacker with basic application execution on the device can trigger a privileged system intermediary to operate on restricted files using its own elevated credentials, achieving full local privilege escalation without any user interaction. No public exploit exists at time of analysis, and CISA SSVC assessment confirms no observed active exploitation.
Local privilege escalation in Android 16 through 17 exploits incorrect authorization (CWE-863) across multiple URI access control locations, allowing a low-privileged process to bypass permissions checks and achieve full read/write/execute access on the device without requiring user interaction. Reported by security@android.com and addressed in the September 2026 Android Security Bulletin, the flaw affects Android 16, Android 16-QPR2, and Android 17. No public exploit has been identified and EPSS sits at the 2nd percentile, though SSVC rates the technical impact as total.
Heap buffer overflow in Android's OAPV video codec decoder (oapv.c) enables remote code execution on Android 16 and 17 without requiring user interaction. The flaw resides in dec_frm_prepare(), where insufficient bounds checking during frame decoding preparation allows an attacker to overwrite heap memory via crafted video content. EPSS sits at 0.18% (8th percentile) with SSVC exploitation status rated 'none', but technical impact is classified as 'total' and no public exploit has been identified at time of analysis.
Local privilege escalation in Android's Setup Wizard allows a low-privileged attacker to force the device to connect to a malicious network by exploiting a confused deputy relationship (CWE-441), achieving full C:H/I:H/A:H compromise without any user interaction. The flaw is addressed in the September 2026 Android Security Bulletin (patch level 2026-09-01) and requires only an existing low-privilege foothold on the device. No public exploit code has been identified, and EPSS sits at 0.11% (2nd percentile), indicating negligible observed exploitation probability at time of analysis.
Local privilege escalation in Android's Slice permission subsystem allows a low-privileged installed application to bypass permission checks via a confused deputy flaw in SlicePermissionActivity.java's onCreate method. Affecting Android 14 through 17 (including the 16-QPR2 branch), the vulnerability requires no user interaction and grants full C:H/I:H/A:H impact on a successful device. No public exploit has been identified at time of analysis, and EPSS scoring (0.12%, 2nd percentile) reflects low current exploitation activity.
Local privilege escalation in Android's ChannelImpl.java allows a low-privileged installed application to launch arbitrary intents by exploiting improper input validation in the initAppLinkTypeAndIntent method. Affected versions span Android 14 through 17, including 16-QPR2. Exploitation requires user interaction, limiting automated attack at scale - SSVC confirms no observed exploitation and EPSS sits at 0.11% (2nd percentile), consistent with the local-access, user-interaction gating.
Local privilege escalation in Android 16, 16-QPR2, and 17 is possible via Intent Redirection by exploiting a logic error in ActivityStarter.java's resolveActivity method. A locally-installed malicious application with basic user privileges can craft or intercept Intents to gain unauthorized access to protected system components, achieving full confidentiality, integrity, and availability compromise of the device without requiring any user interaction after installation. EPSS is 0.12% (2nd percentile) and no active exploitation or public POC has been identified at time of analysis.
Background activity launch (BAL) restrictions in Android 15, 16, 16-qpr2, and 17 can be bypassed by a locally installed application exploiting a confused deputy pattern spanning multiple framework functions. A low-privileged app manipulates one or more privileged Android system components into launching background activities on its behalf, circumventing protections designed to block unauthorized UI intrusion and enabling local privilege escalation with full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; EPSS at 0.12% (2nd percentile) reflects low observed exploitation activity despite the 7.8 CVSS score.
Remote privilege escalation in the Android Bluetooth stack (AdapterService.java) allows an attacker to bypass device pairing entirely. A logic error in handleBondStateChanged lets a bond be treated as established without the normal pairing/consent flow, granting the attacker elevated privileges on Android 15, 16, 16-qpr2, and 17 with no user interaction. Google rates it CVSS 9.8; no public exploit is identified and CISA's SSVC framework records exploitation status as none, and EPSS is very low (0.16%).
Local privilege escalation in Android's AppRestrictionsFragment allows a low-privileged app to gain unauthorized read/write access to private files via a confused deputy in the assertSafeToStartCustomActivity method. Affected versions span Android 14, 15, 16, 16-QPR2, and 17, making this a broad-surface vulnerability across the current Android ecosystem. With PR:L/UI:N, a malicious installed app can silently exploit this without user interaction to achieve full local C:H/I:H/A:H impact. No public exploit identified at time of analysis; EPSS is 0.11% (2nd percentile).
Multi-user isolation breaks in Android's ClipboardService framework layer (CWE-284 Improper Access Control) across Android 14 through 17, enabling a locally-executed low-privileged process to cross user-profile boundaries and escalate privileges with full confidentiality, integrity, and availability impact. The logic error in setClipboardAccessNotificationsEnabledForUser fails to correctly enforce per-user access checks, allowing one user context to manipulate clipboard access notification state for other user profiles on the same device. No public exploit has been identified at time of analysis, and EPSS of 0.12% places this at the 2nd percentile for near-term exploitation probability.
Local privilege escalation in Android's PaymentDefaultDialog allows an attacker with standard app-level execution to silently replace the device's default NFC payment application via a confused deputy in the component's onCreate method. Affecting Android 15, 16, 16-qpr2, and 17, the flaw is patched in the September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, and EPSS sits at 0.11%, consistent with SSVC's 'Exploitation: none' designation despite the high technical impact potential.
Intent redirection bypass in Android's ActivityManagerService enables a low-privileged local app to escalate privileges and gain full device access without any user interaction. The logic error in addCreatorToken of ActivityManagerService.java corrupts the creator-token mechanism that governs Intent origin and authority, allowing a malicious app to redirect Intents to system-protected components that should be inaccessible to it. EPSS at 0.13% (3rd percentile) and no CISA KEV listing indicate limited observed exploitation; no public exploit has been identified at time of analysis.
Local privilege escalation via use-after-free in Android 16-QPR2 and Android 17 allows a low-privileged local attacker to gain full system access with no user interaction required. The vulnerability arises from a logic error present at multiple code locations within the Android codebase, triggering a use-after-free condition that corrupts memory and enables privilege elevation to system or root level. No public exploit has been identified at the time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with no observed active exploitation.
Local privilege escalation in Android's Settings app (SettingsFragment.java) affects Android 14 through 17, including 16-qpr2, allowing a low-privileged local attacker to gain full device control via misleading or insufficient UI in the getItemList method. No victim interaction is required - the attacker's own low-privileged app or session is sufficient to trigger the UI bypass. EPSS is 0.12% (2nd percentile) and SSVC records no active exploitation, but SSVC simultaneously rates technical impact as total, reflecting the severity of a successful attack despite limited observed real-world activity.
Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.
Out-of-bounds write in Android's camera metadata validation logic (validate_camera_metadata_structure in camera_metadata.c) allows a local low-privileged attacker to escalate privileges to a higher-privileged context with full confidentiality, integrity, and availability impact. Affects Android 14 through 16-qpr2, patched in the September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; EPSS sits at the 2nd percentile and SSVC rates exploitation as none.
Tapjacking and UI overlay exploitation in Android 16-QPR2's `InstallLaunch.kt` `onCreate` method allows a locally-installed malicious application to present a deceptive interface over the package installation workflow, leading to local privilege escalation with full confidentiality, integrity, and availability impact. Fixed in Google's September 2026 Android Security Bulletin, the flaw requires no additional execution privileges and - per the CVSS vector - no user interaction beyond what occurs during the overlay setup phase. No public exploit code and no active exploitation have been identified at time of analysis; EPSS sits at 0.11% (2nd percentile).
Local privilege escalation in Android 16 and 16-QPR2 allows a low-privileged app to escalate to full device control by exploiting a logic error in HostEmulationManager.java that permits unauthorized background activity launches. The flaw stems from CWE-693 (Protection Mechanism Failure) in the activity-launch gating logic, enabling an installed malicious app to bypass Android's background activity restrictions without requiring additional permissions or user interaction. No public exploit has been identified and CISA has not added this to KEV, but SSVC rates the technical impact as total given that successful exploitation yields C:H/I:H/A:H on the device.
Local privilege escalation in Android's BackgroundLaunchProcessController allows a low-privileged app or user process to launch background activities beyond its permitted scope due to a logic error in the areBackgroundActivityStartsAllowed gating function. Affected versions span Android 14 through Android 16-QPR2, covering the vast majority of modern Android devices in active use. With PR:L and UI:N, exploitation requires only a foothold as a regular user-space app - no user interaction or elevated permissions - making it a reliable post-installation escalation primitive. No public exploit exists and CISA SSVC rates exploitation as none at time of analysis.
Universal Cross-Site Scripting (UXSS) in UC Browser for Android (com.UCMobile.intl 13.7.8.1314) lets remote attackers run arbitrary JavaScript in the security context of any origin, defeating the same-origin policy. By luring a victim to a reflected-XSS page hosted on a UC-owned domain, an attacker abuses the browser's internal JavaScript bridge to register a deferred callback, silently navigate the tab to a target site, and fire attacker code against that origin when a login dialog is dismissed. EPSS is low (0.15%), there is no CISA KEV listing, and no vendor-confirmed exploit code, though the CVE references two public gists that appear to document the technique.
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in a privileged WebView component. An attacker who can control an external origin loaded within that WebView receives sensitive HTTP headers - including session tokens - that the app fails to suppress, exposing the authenticated user's session and enabling full account takeover. No public exploit has been identified at time of analysis; the flaw is patched in v2.376.0 per the Canva trust advisory.
A missing bounds check in the writeAocCommand routine of AocAudioCodec.cpp on Google Pixel devices using the Tensor Always-on Compute (AoC) audio subsystem can be driven by unauthenticated remote input to corrupt memory and crash the audio codec, yielding a denial of service with no user interaction required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only). The exposure is confined to Pixel/Tensor hardware running firmware prior to the 2026-06-01 Pixel patch level rather than all Android devices, even though the CPE is broad. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and EPSS is low at 0.25% (16th percentile); the affected code path sits inside an on-device codec, so real-world remote reachability remains unconfirmed despite the AV:N vector.
Out-of-bounds read in the cellular Modem (baseband) of Google Pixel/Android devices allows an unauthenticated attacker within cellular radio range to crash the modem by sending a crafted radio-layer or signaling message, causing loss of cellular connectivity (denial of service). The flaw is a missing bounds check during message parsing (CWE-125) and requires no user interaction; only availability is impacted, with no code execution, privilege gain, or data disclosure. No public exploit code identified at time of analysis; EPSS is low at 0.25% and CISA SSVC shows no active exploitation.
Memory corruption through out-of-bounds writes in Android-ImageMagick7 prior to version 7.1.2-11 enables local attackers to achieve arbitrary code execution with user interaction. The vulnerability affects Google's implementation of ImageMagick and carries a CVSS score of 7.8, indicating high severity with complete confidentiality, integrity, and availability impact. A patch is available for affected users.
A critical input validation vulnerability (CWE-20) exists in MolotovCherry Android-ImageMagick7 before version 7.1.2-11 that allows unauthenticated remote attackers to achieve complete system compromise with high impact to confidentiality, integrity, and availability. The vulnerability was reported by GovTech CSG and has a CVSS score of 9.8, indicating network-accessible exploitation with no privileges or user interaction required. A patch is available from the vendor via GitHub pull request #193.
This vulnerability is a memory leak (CWE-401) in Android-ImageMagick7, a port of ImageMagick for Android, that allows remote attackers to cause denial of service by exhausting memory resources. The issue affects all versions of MolotovCherry Android-ImageMagick7 prior to version 7.1.2-11. With a CVSS score of 7.5 and a network-based attack vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), attackers can remotely trigger high-impact availability disruption, though there is no current evidence of active exploitation or public proof-of-concept.
Memory leaks in MolotovCherry Android-ImageMagick7 versions prior to 7.1.2-11 allow remote attackers to cause denial of service by exhausting available memory without authentication. The vulnerability stems from improper memory management that fails to release resources after use, potentially crashing applications or rendering devices unresponsive.
Memory corruption through out-of-bounds write in Android-ImageMagick7 before version 7.1.2-10 enables remote code execution when a user processes a malicious image file. An attacker can exploit this vulnerability over the network without authentication to achieve complete system compromise including data theft, modification, and denial of service. A patch is available for affected Android devices running vulnerable versions of the ImageMagick library.
An integrity check vulnerability in Cryptomator for Android prior to version 1.12.3 allows attackers to tamper with the vault configuration file, enabling a man-in-the-middle attack against the Hub key loading mechanism. Attackers who can modify the vault.cryptomator file can mix legitimate authentication endpoints with malicious API endpoints to exfiltrate tokens from users unlocking Hub-backed vaults. With a CVSS score of 7.6 and requiring low attack complexity with user interaction, this vulnerability poses a moderate risk to affected users in environments where vault configuration files can be altered.
Out-of-bounds memory corruption in Google Chrome's WebGL implementation on Android prior to version 146.0.7680.153 enables remote attackers to escape the browser sandbox by delivering a malicious HTML page, requiring only user interaction. This critical vulnerability affects Chrome users on Android devices and could lead to complete system compromise if successfully exploited. A patch is available in Chrome 146.0.7680.153 and later versions.
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling local attackers to execute arbitrary activities with Secure Folder privileges. This high-severity vulnerability affects users with local device access and could allow privilege escalation or unauthorized access to protected data. No patch is currently available.
Use after free in WebView in Google Chrome on Android versions up to 146.0.7680.71 is affected by use after free (CVSS 8.8).
Insufficient policy enforcement in PDF in Google Chrome on Android versions up to 146.0.7680.71 contains a security vulnerability.
Local privilege escalation in Android results from an out-of-bounds write vulnerability caused by insufficient bounds validation. A local attacker with limited privileges can exploit this flaw without user interaction to gain elevated system permissions. No patch is currently available.
Uncontrolled buffer writes in Android's EfwApTransport component allow local attackers to achieve privilege escalation without requiring user interaction or special permissions. The vulnerability stems from insufficient bounds checking in the ProcessRxRing function, enabling an attacker with local access to corrupt kernel memory and gain elevated privileges.
Unauthenticated local attackers can achieve remote code execution on Android devices through out-of-bounds memory writes that corrupt process memory. This vulnerability requires no user interaction or elevated privileges to exploit and has a CVSS score of 8.4. No patch is currently available.
Modem has a fifth OOB write enabling remote privilege escalation.
Oobconfig on Android contains a logic error that allows local attackers to circumvent carrier restrictions and escalate privileges without requiring additional execution capabilities or user interaction. This vulnerability enables unauthorized privilege elevation on affected devices through a straightforward exploitation path. No patch is currently available to remediate this issue.
Local privilege escalation in Android's Media Framework Codec (MFC) decoder results from an out-of-bounds write vulnerability in the mfc_dec_dqbuf function due to inadequate bounds validation. An attacker with local access can exploit this defect without special privileges or user interaction to gain elevated system permissions. No patch is currently available for this vulnerability.
Samsung/Google MFC driver has an OOB write in mfc_core_isr.c enabling kernel-level privilege escalation on Android devices.
Modem has a fourth OOB write due to incorrect bounds check.
Modem has a third OOB write in cell broadcast utilities.
Local privilege escalation on Android devices occurs through a race condition in the VPU driver's instance opening function, allowing attackers to trigger a use-after-free condition without requiring special privileges or user interaction. An unprivileged local attacker can exploit this vulnerability to gain elevated system privileges. No patch is currently available for this vulnerability.
Modem OOB write in cell broadcast utilities enabling privilege escalation.
Samsung/Qualcomm modem has an out-of-bounds write in NR SM message handling enabling privilege escalation through crafted cellular signaling.
Android versions up to - is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
Android versions up to - contains a vulnerability that allows attackers to local escalation of privilege with no additional execution privileges needed (CVSS 8.4).
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
RustDesk Client through version 1.4.5 transmits sensitive preset address book credentials in cleartext during heartbeat synchronization, enabling network eavesdropping attacks across Windows, macOS, Linux, iOS, and Android platforms. An attacker positioned to intercept network traffic can capture authentication credentials by sniffing the unencrypted JSON payload. No patch is currently available for this high-severity vulnerability (CVSS 8.7).
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
RustDesk Client through version 1.4.5 uses a broken cryptographic algorithm that allows attackers to retrieve sensitive embedded data during config import, URI scheme handling, or CLI operations across Windows, macOS, Linux, iOS, Android, and web clients. An unauthenticated remote attacker can exploit this vulnerability without user interaction to extract sensitive configuration information. No patch is currently available for this high-severity vulnerability.
Heap corruption in Chrome's PowerVR graphics driver on Android versions prior to 145.0.7632.159 can be triggered through malicious HTML pages, potentially enabling remote code execution without user interaction beyond visiting a compromised website. The vulnerability stems from improper object lifecycle management and affects all Android users running vulnerable Chrome versions. A patch is available and should be applied immediately given the high exploitation potential.
F2FS swapfile memory corruption in Linux kernel 6.6+ allows local attackers with user privileges to cause data corruption through improper physical block mapping when using fragmented swapfiles smaller than the F2FS section size. Public exploit code exists for this vulnerability, and attackers can trigger dm-verity corruption errors or F2FS node corruption leading to system crashes and data loss. No patch is currently available.
Android versions up to 16.0 contains a vulnerability that allows attackers to local escalation of privilege with no additional execution privileges needed (CVSS 8.4).
Android versions up to - contains a vulnerability that allows attackers to local escalation of privilege with no additional execution privileges needed (CVSS 8.4).
Local privilege escalation in Android's ffa.c component allows unauthenticated attackers to corrupt memory and gain elevated privileges without user interaction. The vulnerability stems from a logic error in multiple functions and requires only local access to exploit. A patch is available to address this high-severity flaw.
An Android MediaProvider logic error allows local applications to obtain unauthorized read and write access to arbitrary files, enabling privilege escalation without requiring additional permissions or user interaction. This vulnerability affects the createRequest function and permits apps to manipulate file access controls beyond their intended scope. No patch is currently available.
Improper input validation in Android's ManagedServices notification policy handler allows local attackers to escalate privileges without requiring additional permissions or user interaction. An attacker can exploit this flaw to desynchronize notification policies and gain elevated system privileges on the affected device. No patch is currently available for this vulnerability.
A logic error in Android's mem_protect.c enables local attackers to write out-of-bounds memory and escalate privileges without requiring additional permissions or user interaction. This vulnerability affects Android devices and can be exploited by any local user to gain elevated system privileges. A patch is available.
Local privilege escalation in Android's mem_protect.c results from integer overflow conditions that enable out-of-bounds memory writes, allowing unauthenticated local attackers to gain elevated system privileges without user interaction. The vulnerability affects multiple functions within the memory protection component and is exploitable by any process on the affected device. A patch is available to address this high-severity issue.
Local privilege escalation in Android's mem_protect.c allows unprivileged attackers to achieve full system access through an out-of-bounds write caused by insufficient bounds validation. The vulnerability requires no user interaction and can be exploited immediately upon device compromise by any local process.
Local privilege escalation in Android's pKVM hypervisor initialization allows unprivileged attackers to corrupt memory and gain elevated privileges without user interaction. The vulnerability stems from a logic error in the __pkvm_init_vm function that fails to properly validate memory operations during VM setup. A patch is available to address this high-severity flaw affecting Android devices.
Local privilege escalation in Android's __pkvm_host_share_guest function allows unprivileged attackers to achieve kernel-level code execution through integer overflow-induced out-of-bounds memory writes. The vulnerability requires no user interaction and can be exploited directly from any local context on affected devices. A patch is available to address this high-severity flaw.
Local privilege escalation in Android's PermissionManagerServiceImpl allows an attacker to override system permissions through a logic error in the removePermission function. An unprivileged local attacker can exploit this vulnerability with user interaction to gain elevated privileges. No patch is currently available and exploitation requires physical or local access to the device.
Unauthorized information disclosure in Android's Notification.java hasImage method allows local attackers to bypass permission checks and access sensitive data across user accounts without requiring elevated privileges or user interaction. This permissions bypass can lead to local privilege escalation on affected Android devices. No patch is currently available.
Improper permission validation in Android's PackageInstallerService allows a local app to modify its own package ownership without requiring elevated privileges, enabling privilege escalation. An attacker with a malicious app installed on the device can exploit this flaw without user interaction to gain unauthorized access to system resources. No patch is currently available for this vulnerability.
Missing authorization in the WebView component of Google Chrome on Android before 153.0.8010.36 lets a remote attacker who first tricks a user via social engineering bypass system access restrictions through crafted network traffic. The flaw is tracked as CWE-862 (missing authorization) and was reported by Google's Chrome team; a vendor patch is available. Chromium rates the security severity as Medium, EPSS is low (0.17%), and no public exploit or CISA KEV listing has been identified.
Local privilege escalation in the Android kernel's IOMMU subsystem (iommu.c) allows any process with basic user-level execution to gain full kernel privileges through out-of-bounds memory read/write triggered by improper input validation across multiple functions. The CVSS vector (AV:L/AC:L/PR:L/UI:N) confirms low attack complexity with no user interaction required, making this a reliable local privilege escalation primitive for post-compromise chains or malicious apps. Google patched this in the Android Security Bulletin for September 2026 with two upstream kernel commits; no public exploit has been identified at time of analysis.
Local privilege escalation in Android's MountRegistry component across Android 14, 15, 16, and 16-qpr2 allows a low-privileged process to achieve full device compromise via a buffer overflow in the forEachLine function of MountRegistry.cpp. The flaw triggers an out-of-bounds read that can corrupt adjacent memory, enabling an attacker to elevate from a sandboxed app or low-privilege process to a higher system privilege level without any user interaction. No public exploit has been identified at time of analysis, though SSVC rates the technical impact as total.
Remote code execution in Android (versions 14 through 17) arises from improper type casting in multiple functions of ftsmooth.c, the anti-aliased smooth rasterizer of the bundled FreeType font-rendering engine. An attacker can trigger memory corruption through a maliciously crafted font with no user interaction and no additional execution privileges, per the September 2026 Android Security Bulletin. There is no public exploit identified at time of analysis; CISA SSVC lists exploitation status as none but rates the flaw automatable with total technical impact.
Out-of-bounds write in Android's NFC RoutingManager (checkUikcListenConfigNeeded in RoutingManager.cpp) enables remote code execution from adjacent NFC proximity on Android 16-QPR2 and Android 17 without requiring user interaction. The missing bounds check in UICC listen configuration handling allows a proximal attacker to corrupt memory in the NFC daemon, leading to full code execution in that process context. No public exploit has been identified at time of analysis; SSVC rates technical impact as total but exploitation status as none.
Local privilege escalation in Android 16, 16-QPR2, and 17 stems from improper input validation in the AppendCommentLine function of AnnotationProcessor.cpp. A low-privileged local attacker can exploit this CWE-20 flaw without user interaction to achieve full confidentiality, integrity, and availability impact, consistent with a complete privilege escalation on the device. Google's Android Security Bulletin for September 2026 (2026-09-01) addresses this issue; the description's explicit 'supply chain risk' framing is atypical and suggests the vulnerable code participates in a build or annotation-processing pipeline where malicious input could propagate into compiled artifacts.
Remote code execution in Google Android (versions 14 through 17, including 16-qpr2) arises from a heap buffer overflow (CWE-122) present in multiple system code paths, per the September 2026 Android Security Bulletin. The flaw is reported by Google's Android security team as exploitable with no additional execution privileges and no user interaction, giving a remote attacker full compromise of the affected process context. SSVC rates exploitation as 'none' and there is no public exploit identified at time of analysis, but CISA's automatable=yes / technical-impact=total assessment marks it as a high-priority patch target.
Integer overflow in FreeType's COLR color-layer blending function (tt_face_colr_blend_layer in ttcolr.c) enables local privilege escalation across Android 14 through 17. A low-privileged app can deliver a maliciously crafted TrueType font containing a corrupted COLR table, triggering arithmetic overflow that corrupts heap memory and enables code execution in a higher-privileged system context. No active exploitation has been identified (EPSS 0.15%, SSVC Exploitation: none), and no user interaction beyond app execution is required.
Remote code execution is achievable in Android's NFC subsystem across Android 14 through 17, including Android 16-QPR2, via a heap buffer overflow in the MIFARE Classic tag reader function rw_mfc_handle_read_op() within rw_mfc.cc. An attacker within NFC proximity can present a crafted MIFARE Classic tag that overflows a heap-allocated buffer in the NFC daemon, yielding full device control with no victim interaction required and no privileges needed on the target. No public exploit has been identified at time of analysis, though the SSVC framework rates the technical impact as total given the unauthenticated RCE capability.
Remote code execution is possible in Android's NFC Type 3 Tag processing layer (rw_t3t.cc within libnfc-nci) across Android 14 through 17 via an integer overflow that triggers a heap out-of-bounds write. No user interaction or additional privileges are required per the description, making this exploitable by any attacker within NFC proximity of an unpatched device. Google addressed this in the September 2026 Android Security Bulletin; no public exploit or active exploitation has been identified at time of analysis, and CISA's SSVC framework classifies current exploitation status as 'none'.
Heap buffer overflow in the `read_boot_region` function of Android's filesystem check utility (`fsck.c`) allows a local, low-privileged process to escalate privileges with full system impact. The flaw spans Android 14 through 17 (including QPR2 branches) and was disclosed in Google's September 2026 Android Security Bulletin. No public exploit code has been identified at time of analysis, and EPSS signals a very low current exploitation probability.
Local privilege escalation in Android's StorageManagerService (Android 14 through 17) stems from an unsafe PendingIntent in getManageSpaceActivityIntent that enables a LaunchAnyWhere attack chain, allowing a malicious low-privilege app to intercept and redirect activity launches into privileged system contexts. The vulnerability requires user interaction - specifically navigating the storage management UI - but once triggered, yields full compromise of confidentiality, integrity, and availability on the device. No public exploit has been identified at time of analysis; Google's September 2026 Android Security Bulletin documents the fix.
Heap buffer overflow in Android's Bluetooth A2DP Opus vendor codec decoder allows a local low-privileged attacker to escalate privileges with no user interaction required. The flaw resides in `a2dp_vendor_opus_decoder_decode_packet` within `a2dp_vendor_opus_decoder.cc`, where a crafted Opus-encoded audio stream can trigger an out-of-bounds write on the heap. Affected versions span Android 14 through Android 17; no public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none.
Local privilege escalation in Android's runtime image writer (WriteImageToDisk, runtime_image.cc) allows a low-privileged local process to tamper with files through a logic error, potentially gaining full system control. Affected versions span Android 14 through Android 17, including the Android 16-QPR2 branch, making this a broad-impact flaw across the current and future Android release train. No public exploit has been identified at time of analysis, and SSVC indicates exploitation is currently none, but the Technical Impact rating of 'total' underscores the severity if exploited.
Background Activity Launch (BAL) bypass in Android's LauncherAppsService allows a low-privilege local application to launch foreground activities from the background without user awareness or interaction. The flaw resides in `buildIntentSenderForUser` within `LauncherAppsService.java`, where authorization checks (CWE-863) are insufficient to prevent background callers from obtaining a valid intent sender that sidesteps Android's BAL restrictions. Affected versions include Android 16, Android 16-QPR2, and Android 17; no public exploit identified at time of analysis.
Factory Reset Protection (FRP) in Android 14 through 17 can be bypassed via a logic error in `findMetaAuthUid` within `AccountsDb.java`, allowing a local attacker with minimal privileges to gain full control of a device without additional permissions or any victim interaction. All currently supported Android major versions are confirmed affected per Google's September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, though the total CIA impact (C:H/I:H/A:H) means successful exploitation yields complete device compromise.
Local privilege escalation in Android's AppWidgetConfigActivityProxy allows a low-privileged installed application to illicitly obtain URI permissions through a confused deputy flaw in the onActivityResult handler of AppWidgetConfigActivityProxy.java. Affected versions are Android 16-QPR2 and Android 17; the September 2026 Android Security Bulletin provides the fix. No public exploit code or active exploitation (KEV) has been identified; EPSS at 0.12% and SSVC 'Exploitation: none' confirm low observed activity, though SSVC rates the technical impact as total.
Local privilege escalation in Android's NFC Type 3 Tag (T3T) reader/writer component affects Android 14 through 17, including the Android 16 QPR2 branch. Multiple functions in rw_t3t.cc contain an integer overflow that leads to an out-of-bounds write, enabling a low-privileged local process to gain full system-level access without any user interaction. No public exploit code has been identified at time of analysis, and the EPSS score of 0.11% places this in the 2nd percentile for near-term exploitation probability.
Local privilege escalation in Android's Window Manager Service (WindowState.java) allows a low-privileged app to bypass overlay protection mechanisms across Android versions 14 through 17. The logic error in setHiddenWhileSuspended permits unauthorized overlay windows to remain visible or interact with the display even when they should be hidden for suspended apps, creating a pathway to full CIA compromise on the device. No public exploit has been identified at time of analysis, and EPSS scores the exploitation probability at just 0.13% (3rd percentile), though SSVC rates technical impact as total.
Local privilege escalation in Android 14 through 16 allows a low-privileged application to gain full system-level access by exploiting a confused deputy flaw in the ActivityTaskManagerService. The vulnerability exists in the startNextMatchingActivity method of ActivityTaskManagerService.java, where the service can be manipulated into exercising its elevated permissions on behalf of an unprivileged caller, bypassing Android's permission model. No additional execution privileges or user interaction are required, and no public exploit has been identified at time of analysis.
Local privilege escalation in Android's telephony stack allows a low-privilege app to send USSD requests without the required telephony permission, bypassing Android's permission model through a logic error in handleUssdRequest of PhoneInterfaceManager.java. Affected releases span Android 14 through 17 including the 16-QPR2 branch, with no user interaction required post-installation. USSD access can reach carrier-side services capable of triggering sensitive device operations, making a successful exploit a pathway to full device compromise.
Privilege escalation in Android's cross-profile intent-forwarding mechanism (IntentForwarderActivity.java) allows a locally installed low-privilege application to bypass the user consent dialog presented by buildMiniResolver via a tapjacking or overlay attack, achieving full confidentiality, integrity, and availability impact across Android 14 through 17 including the QPR2 train. The vendor explicitly states no user interaction is required, indicating the consent bypass is mechanically triggered against the framework rather than requiring the victim to tap attacker-crafted UI. No public exploit or CISA KEV listing exists at time of analysis; EPSS of 0.12% (2nd percentile) and SSVC Automatable=no confirm no observed mass exploitation.
Intent redirection in Android's SetupPassthroughActivity allows a locally present, low-privilege attacker to launch arbitrary activities and escalate privileges to a higher-trust system level. Affecting Android 14 through 17 (including 16-qpr2), the flaw resides in the onCreate method of SetupPassthroughActivity.java and requires user interaction to trigger. No public exploit is identified at time of analysis, and an EPSS of 0.11% (2nd percentile) indicates minimal current exploitation probability, consistent with the SSVC exploitation-none signal.
Local privilege escalation in Android 16 and 17 exploits a confused deputy (CWE-441) vulnerability present across multiple system locations, allowing a low-privileged local process to read and write files it is not authorized to access. An attacker with basic application execution on the device can trigger a privileged system intermediary to operate on restricted files using its own elevated credentials, achieving full local privilege escalation without any user interaction. No public exploit exists at time of analysis, and CISA SSVC assessment confirms no observed active exploitation.
Local privilege escalation in Android 16 through 17 exploits incorrect authorization (CWE-863) across multiple URI access control locations, allowing a low-privileged process to bypass permissions checks and achieve full read/write/execute access on the device without requiring user interaction. Reported by security@android.com and addressed in the September 2026 Android Security Bulletin, the flaw affects Android 16, Android 16-QPR2, and Android 17. No public exploit has been identified and EPSS sits at the 2nd percentile, though SSVC rates the technical impact as total.
Heap buffer overflow in Android's OAPV video codec decoder (oapv.c) enables remote code execution on Android 16 and 17 without requiring user interaction. The flaw resides in dec_frm_prepare(), where insufficient bounds checking during frame decoding preparation allows an attacker to overwrite heap memory via crafted video content. EPSS sits at 0.18% (8th percentile) with SSVC exploitation status rated 'none', but technical impact is classified as 'total' and no public exploit has been identified at time of analysis.
Local privilege escalation in Android's Setup Wizard allows a low-privileged attacker to force the device to connect to a malicious network by exploiting a confused deputy relationship (CWE-441), achieving full C:H/I:H/A:H compromise without any user interaction. The flaw is addressed in the September 2026 Android Security Bulletin (patch level 2026-09-01) and requires only an existing low-privilege foothold on the device. No public exploit code has been identified, and EPSS sits at 0.11% (2nd percentile), indicating negligible observed exploitation probability at time of analysis.
Local privilege escalation in Android's Slice permission subsystem allows a low-privileged installed application to bypass permission checks via a confused deputy flaw in SlicePermissionActivity.java's onCreate method. Affecting Android 14 through 17 (including the 16-QPR2 branch), the vulnerability requires no user interaction and grants full C:H/I:H/A:H impact on a successful device. No public exploit has been identified at time of analysis, and EPSS scoring (0.12%, 2nd percentile) reflects low current exploitation activity.
Local privilege escalation in Android's ChannelImpl.java allows a low-privileged installed application to launch arbitrary intents by exploiting improper input validation in the initAppLinkTypeAndIntent method. Affected versions span Android 14 through 17, including 16-QPR2. Exploitation requires user interaction, limiting automated attack at scale - SSVC confirms no observed exploitation and EPSS sits at 0.11% (2nd percentile), consistent with the local-access, user-interaction gating.
Local privilege escalation in Android 16, 16-QPR2, and 17 is possible via Intent Redirection by exploiting a logic error in ActivityStarter.java's resolveActivity method. A locally-installed malicious application with basic user privileges can craft or intercept Intents to gain unauthorized access to protected system components, achieving full confidentiality, integrity, and availability compromise of the device without requiring any user interaction after installation. EPSS is 0.12% (2nd percentile) and no active exploitation or public POC has been identified at time of analysis.
Background activity launch (BAL) restrictions in Android 15, 16, 16-qpr2, and 17 can be bypassed by a locally installed application exploiting a confused deputy pattern spanning multiple framework functions. A low-privileged app manipulates one or more privileged Android system components into launching background activities on its behalf, circumventing protections designed to block unauthorized UI intrusion and enabling local privilege escalation with full confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis; EPSS at 0.12% (2nd percentile) reflects low observed exploitation activity despite the 7.8 CVSS score.
Remote privilege escalation in the Android Bluetooth stack (AdapterService.java) allows an attacker to bypass device pairing entirely. A logic error in handleBondStateChanged lets a bond be treated as established without the normal pairing/consent flow, granting the attacker elevated privileges on Android 15, 16, 16-qpr2, and 17 with no user interaction. Google rates it CVSS 9.8; no public exploit is identified and CISA's SSVC framework records exploitation status as none, and EPSS is very low (0.16%).
Local privilege escalation in Android's AppRestrictionsFragment allows a low-privileged app to gain unauthorized read/write access to private files via a confused deputy in the assertSafeToStartCustomActivity method. Affected versions span Android 14, 15, 16, 16-QPR2, and 17, making this a broad-surface vulnerability across the current Android ecosystem. With PR:L/UI:N, a malicious installed app can silently exploit this without user interaction to achieve full local C:H/I:H/A:H impact. No public exploit identified at time of analysis; EPSS is 0.11% (2nd percentile).
Multi-user isolation breaks in Android's ClipboardService framework layer (CWE-284 Improper Access Control) across Android 14 through 17, enabling a locally-executed low-privileged process to cross user-profile boundaries and escalate privileges with full confidentiality, integrity, and availability impact. The logic error in setClipboardAccessNotificationsEnabledForUser fails to correctly enforce per-user access checks, allowing one user context to manipulate clipboard access notification state for other user profiles on the same device. No public exploit has been identified at time of analysis, and EPSS of 0.12% places this at the 2nd percentile for near-term exploitation probability.
Local privilege escalation in Android's PaymentDefaultDialog allows an attacker with standard app-level execution to silently replace the device's default NFC payment application via a confused deputy in the component's onCreate method. Affecting Android 15, 16, 16-qpr2, and 17, the flaw is patched in the September 2026 Android Security Bulletin. No public exploit has been identified at time of analysis, and EPSS sits at 0.11%, consistent with SSVC's 'Exploitation: none' designation despite the high technical impact potential.
Intent redirection bypass in Android's ActivityManagerService enables a low-privileged local app to escalate privileges and gain full device access without any user interaction. The logic error in addCreatorToken of ActivityManagerService.java corrupts the creator-token mechanism that governs Intent origin and authority, allowing a malicious app to redirect Intents to system-protected components that should be inaccessible to it. EPSS at 0.13% (3rd percentile) and no CISA KEV listing indicate limited observed exploitation; no public exploit has been identified at time of analysis.
Local privilege escalation via use-after-free in Android 16-QPR2 and Android 17 allows a low-privileged local attacker to gain full system access with no user interaction required. The vulnerability arises from a logic error present at multiple code locations within the Android codebase, triggering a use-after-free condition that corrupts memory and enables privilege elevation to system or root level. No public exploit has been identified at the time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with no observed active exploitation.
Local privilege escalation in Android's Settings app (SettingsFragment.java) affects Android 14 through 17, including 16-qpr2, allowing a low-privileged local attacker to gain full device control via misleading or insufficient UI in the getItemList method. No victim interaction is required - the attacker's own low-privileged app or session is sufficient to trigger the UI bypass. EPSS is 0.12% (2nd percentile) and SSVC records no active exploitation, but SSVC simultaneously rates technical impact as total, reflecting the severity of a successful attack despite limited observed real-world activity.
Local privilege escalation in Android 14, 15, and 16 stems from improper encryption key validation caused by a logic error (CWE-347) present across multiple code locations. A low-privileged local attacker can exploit the flawed key verification path to gain full confidentiality, integrity, and availability impact over the device without requiring user interaction or elevated starting privileges. No public exploit has been identified at time of analysis, and EPSS probability sits at 0.11% (2nd percentile), but the vulnerability spans multiple Android versions in active deployment.
Out-of-bounds write in Android's camera metadata validation logic (validate_camera_metadata_structure in camera_metadata.c) allows a local low-privileged attacker to escalate privileges to a higher-privileged context with full confidentiality, integrity, and availability impact. Affects Android 14 through 16-qpr2, patched in the September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; EPSS sits at the 2nd percentile and SSVC rates exploitation as none.
Tapjacking and UI overlay exploitation in Android 16-QPR2's `InstallLaunch.kt` `onCreate` method allows a locally-installed malicious application to present a deceptive interface over the package installation workflow, leading to local privilege escalation with full confidentiality, integrity, and availability impact. Fixed in Google's September 2026 Android Security Bulletin, the flaw requires no additional execution privileges and - per the CVSS vector - no user interaction beyond what occurs during the overlay setup phase. No public exploit code and no active exploitation have been identified at time of analysis; EPSS sits at 0.11% (2nd percentile).
Local privilege escalation in Android 16 and 16-QPR2 allows a low-privileged app to escalate to full device control by exploiting a logic error in HostEmulationManager.java that permits unauthorized background activity launches. The flaw stems from CWE-693 (Protection Mechanism Failure) in the activity-launch gating logic, enabling an installed malicious app to bypass Android's background activity restrictions without requiring additional permissions or user interaction. No public exploit has been identified and CISA has not added this to KEV, but SSVC rates the technical impact as total given that successful exploitation yields C:H/I:H/A:H on the device.
Local privilege escalation in Android's BackgroundLaunchProcessController allows a low-privileged app or user process to launch background activities beyond its permitted scope due to a logic error in the areBackgroundActivityStartsAllowed gating function. Affected versions span Android 14 through Android 16-QPR2, covering the vast majority of modern Android devices in active use. With PR:L and UI:N, exploitation requires only a foothold as a regular user-space app - no user interaction or elevated permissions - making it a reliable post-installation escalation primitive. No public exploit exists and CISA SSVC rates exploitation as none at time of analysis.
Universal Cross-Site Scripting (UXSS) in UC Browser for Android (com.UCMobile.intl 13.7.8.1314) lets remote attackers run arbitrary JavaScript in the security context of any origin, defeating the same-origin policy. By luring a victim to a reflected-XSS page hosted on a UC-owned domain, an attacker abuses the browser's internal JavaScript bridge to register a deferred callback, silently navigate the tab to a target site, and fire attacker code against that origin when a login dialog is dismissed. EPSS is low (0.15%), there is no CISA KEV listing, and no vendor-confirmed exploit code, though the CVE references two public gists that appear to document the technique.
Session hijacking in the Canva Android App before version 2.376.0 arises from an unrestricted header-reflection flaw in a privileged WebView component. An attacker who can control an external origin loaded within that WebView receives sensitive HTTP headers - including session tokens - that the app fails to suppress, exposing the authenticated user's session and enabling full account takeover. No public exploit has been identified at time of analysis; the flaw is patched in v2.376.0 per the Canva trust advisory.
A missing bounds check in the writeAocCommand routine of AocAudioCodec.cpp on Google Pixel devices using the Tensor Always-on Compute (AoC) audio subsystem can be driven by unauthenticated remote input to corrupt memory and crash the audio codec, yielding a denial of service with no user interaction required (CVSS 7.5, AV:N/AC:L/PR:N/UI:N, availability-only). The exposure is confined to Pixel/Tensor hardware running firmware prior to the 2026-06-01 Pixel patch level rather than all Android devices, even though the CPE is broad. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and EPSS is low at 0.25% (16th percentile); the affected code path sits inside an on-device codec, so real-world remote reachability remains unconfirmed despite the AV:N vector.
Out-of-bounds read in the cellular Modem (baseband) of Google Pixel/Android devices allows an unauthenticated attacker within cellular radio range to crash the modem by sending a crafted radio-layer or signaling message, causing loss of cellular connectivity (denial of service). The flaw is a missing bounds check during message parsing (CWE-125) and requires no user interaction; only availability is impacted, with no code execution, privilege gain, or data disclosure. No public exploit code identified at time of analysis; EPSS is low at 0.25% and CISA SSVC shows no active exploitation.
Memory corruption through out-of-bounds writes in Android-ImageMagick7 prior to version 7.1.2-11 enables local attackers to achieve arbitrary code execution with user interaction. The vulnerability affects Google's implementation of ImageMagick and carries a CVSS score of 7.8, indicating high severity with complete confidentiality, integrity, and availability impact. A patch is available for affected users.
A critical input validation vulnerability (CWE-20) exists in MolotovCherry Android-ImageMagick7 before version 7.1.2-11 that allows unauthenticated remote attackers to achieve complete system compromise with high impact to confidentiality, integrity, and availability. The vulnerability was reported by GovTech CSG and has a CVSS score of 9.8, indicating network-accessible exploitation with no privileges or user interaction required. A patch is available from the vendor via GitHub pull request #193.
This vulnerability is a memory leak (CWE-401) in Android-ImageMagick7, a port of ImageMagick for Android, that allows remote attackers to cause denial of service by exhausting memory resources. The issue affects all versions of MolotovCherry Android-ImageMagick7 prior to version 7.1.2-11. With a CVSS score of 7.5 and a network-based attack vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N), attackers can remotely trigger high-impact availability disruption, though there is no current evidence of active exploitation or public proof-of-concept.
Memory leaks in MolotovCherry Android-ImageMagick7 versions prior to 7.1.2-11 allow remote attackers to cause denial of service by exhausting available memory without authentication. The vulnerability stems from improper memory management that fails to release resources after use, potentially crashing applications or rendering devices unresponsive.
Memory corruption through out-of-bounds write in Android-ImageMagick7 before version 7.1.2-10 enables remote code execution when a user processes a malicious image file. An attacker can exploit this vulnerability over the network without authentication to achieve complete system compromise including data theft, modification, and denial of service. A patch is available for affected Android devices running vulnerable versions of the ImageMagick library.
An integrity check vulnerability in Cryptomator for Android prior to version 1.12.3 allows attackers to tamper with the vault configuration file, enabling a man-in-the-middle attack against the Hub key loading mechanism. Attackers who can modify the vault.cryptomator file can mix legitimate authentication endpoints with malicious API endpoints to exfiltrate tokens from users unlocking Hub-backed vaults. With a CVSS score of 7.6 and requiring low attack complexity with user interaction, this vulnerability poses a moderate risk to affected users in environments where vault configuration files can be altered.
Out-of-bounds memory corruption in Google Chrome's WebGL implementation on Android prior to version 146.0.7680.153 enables remote attackers to escape the browser sandbox by delivering a malicious HTML page, requiring only user interaction. This critical vulnerability affects Chrome users on Android devices and could lead to complete system compromise if successfully exploited. A patch is available in Chrome 146.0.7680.153 and later versions.
Google's Secure Folder prior to the March 2026 SMR release improperly exports Android application components, enabling local attackers to execute arbitrary activities with Secure Folder privileges. This high-severity vulnerability affects users with local device access and could allow privilege escalation or unauthorized access to protected data. No patch is currently available.
Use after free in WebView in Google Chrome on Android versions up to 146.0.7680.71 is affected by use after free (CVSS 8.8).
Insufficient policy enforcement in PDF in Google Chrome on Android versions up to 146.0.7680.71 contains a security vulnerability.
Local privilege escalation in Android results from an out-of-bounds write vulnerability caused by insufficient bounds validation. A local attacker with limited privileges can exploit this flaw without user interaction to gain elevated system permissions. No patch is currently available.
Uncontrolled buffer writes in Android's EfwApTransport component allow local attackers to achieve privilege escalation without requiring user interaction or special permissions. The vulnerability stems from insufficient bounds checking in the ProcessRxRing function, enabling an attacker with local access to corrupt kernel memory and gain elevated privileges.
Unauthenticated local attackers can achieve remote code execution on Android devices through out-of-bounds memory writes that corrupt process memory. This vulnerability requires no user interaction or elevated privileges to exploit and has a CVSS score of 8.4. No patch is currently available.
Modem has a fifth OOB write enabling remote privilege escalation.
Oobconfig on Android contains a logic error that allows local attackers to circumvent carrier restrictions and escalate privileges without requiring additional execution capabilities or user interaction. This vulnerability enables unauthorized privilege elevation on affected devices through a straightforward exploitation path. No patch is currently available to remediate this issue.
Local privilege escalation in Android's Media Framework Codec (MFC) decoder results from an out-of-bounds write vulnerability in the mfc_dec_dqbuf function due to inadequate bounds validation. An attacker with local access can exploit this defect without special privileges or user interaction to gain elevated system permissions. No patch is currently available for this vulnerability.
Samsung/Google MFC driver has an OOB write in mfc_core_isr.c enabling kernel-level privilege escalation on Android devices.
Modem has a fourth OOB write due to incorrect bounds check.
Modem has a third OOB write in cell broadcast utilities.
Local privilege escalation on Android devices occurs through a race condition in the VPU driver's instance opening function, allowing attackers to trigger a use-after-free condition without requiring special privileges or user interaction. An unprivileged local attacker can exploit this vulnerability to gain elevated system privileges. No patch is currently available for this vulnerability.
Modem OOB write in cell broadcast utilities enabling privilege escalation.
Samsung/Qualcomm modem has an out-of-bounds write in NR SM message handling enabling privilege escalation through crafted cellular signaling.
Android versions up to - is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
Android versions up to - contains a vulnerability that allows attackers to local escalation of privilege with no additional execution privileges needed (CVSS 8.4).
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
RustDesk Client through version 1.4.5 transmits sensitive preset address book credentials in cleartext during heartbeat synchronization, enabling network eavesdropping attacks across Windows, macOS, Linux, iOS, and Android platforms. An attacker positioned to intercept network traffic can capture authentication credentials by sniffing the unencrypted JSON payload. No patch is currently available for this high-severity vulnerability (CVSS 8.7).
Security vulnerability in RustDesk remote desktop client/server. One of 6+ critical CVEs affecting the open-source remote access platform.
RustDesk Client through version 1.4.5 uses a broken cryptographic algorithm that allows attackers to retrieve sensitive embedded data during config import, URI scheme handling, or CLI operations across Windows, macOS, Linux, iOS, Android, and web clients. An unauthenticated remote attacker can exploit this vulnerability without user interaction to extract sensitive configuration information. No patch is currently available for this high-severity vulnerability.
Heap corruption in Chrome's PowerVR graphics driver on Android versions prior to 145.0.7632.159 can be triggered through malicious HTML pages, potentially enabling remote code execution without user interaction beyond visiting a compromised website. The vulnerability stems from improper object lifecycle management and affects all Android users running vulnerable Chrome versions. A patch is available and should be applied immediately given the high exploitation potential.
F2FS swapfile memory corruption in Linux kernel 6.6+ allows local attackers with user privileges to cause data corruption through improper physical block mapping when using fragmented swapfiles smaller than the F2FS section size. Public exploit code exists for this vulnerability, and attackers can trigger dm-verity corruption errors or F2FS node corruption leading to system crashes and data loss. No patch is currently available.
Android versions up to 16.0 contains a vulnerability that allows attackers to local escalation of privilege with no additional execution privileges needed (CVSS 8.4).
Android versions up to - contains a vulnerability that allows attackers to local escalation of privilege with no additional execution privileges needed (CVSS 8.4).
Local privilege escalation in Android's ffa.c component allows unauthenticated attackers to corrupt memory and gain elevated privileges without user interaction. The vulnerability stems from a logic error in multiple functions and requires only local access to exploit. A patch is available to address this high-severity flaw.
An Android MediaProvider logic error allows local applications to obtain unauthorized read and write access to arbitrary files, enabling privilege escalation without requiring additional permissions or user interaction. This vulnerability affects the createRequest function and permits apps to manipulate file access controls beyond their intended scope. No patch is currently available.
Improper input validation in Android's ManagedServices notification policy handler allows local attackers to escalate privileges without requiring additional permissions or user interaction. An attacker can exploit this flaw to desynchronize notification policies and gain elevated system privileges on the affected device. No patch is currently available for this vulnerability.
A logic error in Android's mem_protect.c enables local attackers to write out-of-bounds memory and escalate privileges without requiring additional permissions or user interaction. This vulnerability affects Android devices and can be exploited by any local user to gain elevated system privileges. A patch is available.
Local privilege escalation in Android's mem_protect.c results from integer overflow conditions that enable out-of-bounds memory writes, allowing unauthenticated local attackers to gain elevated system privileges without user interaction. The vulnerability affects multiple functions within the memory protection component and is exploitable by any process on the affected device. A patch is available to address this high-severity issue.
Local privilege escalation in Android's mem_protect.c allows unprivileged attackers to achieve full system access through an out-of-bounds write caused by insufficient bounds validation. The vulnerability requires no user interaction and can be exploited immediately upon device compromise by any local process.
Local privilege escalation in Android's pKVM hypervisor initialization allows unprivileged attackers to corrupt memory and gain elevated privileges without user interaction. The vulnerability stems from a logic error in the __pkvm_init_vm function that fails to properly validate memory operations during VM setup. A patch is available to address this high-severity flaw affecting Android devices.
Local privilege escalation in Android's __pkvm_host_share_guest function allows unprivileged attackers to achieve kernel-level code execution through integer overflow-induced out-of-bounds memory writes. The vulnerability requires no user interaction and can be exploited directly from any local context on affected devices. A patch is available to address this high-severity flaw.
Local privilege escalation in Android's PermissionManagerServiceImpl allows an attacker to override system permissions through a logic error in the removePermission function. An unprivileged local attacker can exploit this vulnerability with user interaction to gain elevated privileges. No patch is currently available and exploitation requires physical or local access to the device.
Unauthorized information disclosure in Android's Notification.java hasImage method allows local attackers to bypass permission checks and access sensitive data across user accounts without requiring elevated privileges or user interaction. This permissions bypass can lead to local privilege escalation on affected Android devices. No patch is currently available.
Improper permission validation in Android's PackageInstallerService allows a local app to modify its own package ownership without requiring elevated privileges, enabling privilege escalation. An attacker with a malicious app installed on the device can exploit this flaw without user interaction to gain unauthorized access to system resources. No patch is currently available for this vulnerability.