Android
Monthly
Android versions up to 14.0 contains a vulnerability that allows attackers to local escalation of privilege with no additional execution privileges needed (CVSS 8.4).
Android versions up to 14.0 is affected by authorization bypass through user-controlled key (CVSS 8.4).
Android versions up to 14.0 is affected by improper restriction of rendered ui layers or frames (CVSS 8.6).
Android has a heap buffer overflow in multiple locations enabling privilege escalation through out-of-bounds read and write operations.
Local privilege escalation in Android's PCIe driver allows system-level attackers to execute arbitrary code through an out-of-bounds write caused by insufficient bounds validation. Exploitation requires pre-existing system privileges but no user interaction, enabling a compromised system component to gain complete device control. No patch is currently available.
Remote control vulnerability in Unitree Go2 robot dog firmware 1.1.7-1.1.11. The companion Android app allows remote attackers to take control of the robot. PoC available.
Missing bounds check in Android VPU (Video Processing Unit) driver's vpu_mmap allows arbitrary address memory mapping, potentially leading to local privilege escalation on Android devices.
Android versions up to 14.0 contains a vulnerability that allows attackers to launch arbitrary activity with Samsung Dialer privilege (CVSS 7.8).
Android versions up to 15.0 contains a vulnerability that allows attackers to launch arbitrary activity with Settings privilege (CVSS 7.8).
The Android cameraisp component contains an out-of-bounds write vulnerability due to insufficient bounds validation, enabling privilege escalation for attackers who have already gained system-level access. No user interaction is required for exploitation, and the vulnerability affects confidentiality, integrity, and availability of the device. No patch is currently available.
A use-after-free vulnerability in Android's cameraisp component allows privilege escalation to local denial of service for attackers with system-level access, requiring no user interaction. The flaw enables malicious actors to manipulate memory safety boundaries and execute arbitrary actions within the camera service context. No patch is currently available for this vulnerability.
An out-of-bounds write vulnerability in Android's imgsys component allows a local attacker with system-level privileges to escalate permissions and gain complete control over the device due to insufficient bounds checking. The vulnerability requires no user interaction and cannot be patched in current versions. This affects Android devices where an attacker has already obtained elevated system access.
MobSF versions prior to 4.4.5 are vulnerable to stored XSS through unsanitized rendering of Android manifest attributes in HTML reports, allowing attackers to inject malicious JavaScript by uploading crafted APK files. Public exploit code exists for this vulnerability, and successful exploitation enables session hijacking and account takeover of security analysts using the framework. Upgrade to version 4.4.5 or later to remediate.
Chrome for Android prior to 144.0.7559.59 has a security UI spoofing vulnerability that allows remote attackers to display misleading security indicators.
Arbitrary code execution in the Android PROCA driver before the January 2026 security update results from a use-after-free vulnerability accessible to local attackers with basic privileges. An attacker with local access can exploit this memory safety flaw to execute arbitrary code with elevated privileges on affected devices. No patch is currently available for this high-severity vulnerability.
Android versions up to 15.0 contains a vulnerability that allows attackers to execute the privileged APIs (CVSS 7.8).
Remote code execution in Samsung Android's Quram image codec (libimagecodec.quram.so) allows unauthenticated attackers to execute arbitrary code on affected devices running Android 13.0 with SMR levels prior to Sep-2025 Release 1 by supplying a crafted image. This is confirmed actively exploited (CISA KEV), and exploitation requires no authentication or user interaction, though the malicious image must reach an auto-decoding path such as messaging previews or thumbnail generation; code execution occurs in the context of the invoking component. EPSS is 4.91% (90th percentile), indicating elevated risk, and the CVSS is 9.8.
Remote code execution in Samsung Android 13's Quram image codec (libimagecodec.quram.so) allows unauthenticated, zero-click attackers to corrupt memory by having the device decode a crafted image, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector scoring 9.8. The flaw is confirmed actively exploited (CISA KEV) and was observed in the wild as part of the LANDFALL commercial-grade Android spyware chain, with EPSS at 1.84% (83rd percentile) - low in absolute terms but elevated in rank, consistent with targeted rather than mass exploitation. Only devices running Samsung Android 13 builds with security patch levels prior to SMR Apr-2025 Release 1 are affected, and exploitation in the wild has been selective, so the primary exposure driver is unpatched devices still receiving/dismissing images through messaging and media pipelines.
Android Chrome sandbox contains a use-after-free enabling sandbox escape and local privilege escalation to attack the Android system_server process.
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
there is a possible way to bypass due to a logic error in the code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
there is a possible way to bypass due to a logic error in the code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
there is a possible Information Disclosure due to uninitialized data. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
In WorkSource, there is a possible parcel mismatch. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. Rated medium severity (CVSS 6.4). No vendor patch available.
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. Rated medium severity (CVSS 6.4). No vendor patch available.
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised. Rated medium severity (CVSS 6.4). No vendor patch available.
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 59.7%.
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 87.0%.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 90.3%.
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 76.4%.
Information disclosure in the Vehicle Inspection Certificate Viewer mobile application for Android and iOS causes the app to include API integration credentials - an access ID and an access key - inside the data it transmits, so anyone who can observe or intercept that client-server traffic can recover the credentials. Both platform editions are listed as affected with no version constraint (CPE wildcards for the Android and iOS builds), and the vendor advisory (JVN#94004488, reported to JPCERT) does not identify a fixed release. Exploitation is not trivial: it requires an attacker to obtain a network vantage point such as a man-in-the-middle position on the app's communication path, and there is no public exploit identified at time of analysis; with CVSS 5.3 (C:L/I:N/A:N) the practical impact depends on what the leaked credentials authorize.
Intent redirection and improper access control in the AgentWeb Android WebView library (agentweb-core through 5.1.6-androidx) lets attacker-influenced web content loaded inside a host app's WebView launch that host app's own non-exported components and coerce URI permission grants for the host's ContentProviders by supplying crafted intent:// URLs that DefaultWebClient parses and fires under the host Activity's identity. The vulnerability is exploitable unauthenticated and remotely with no user interaction beyond the app rendering untrusted content (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), although real impact is bounded by the host app's own component and provider surface and by the host exposing sensitive non-exported components or providers; components belonging to other applications remain gated by the OS exported check. No public exploit identified at time of analysis, and the project has released a fixed version, 5.1.7-androidx, via commit 9efb1519.
Path traversal in MP Manager through 1.1.0 allows a local attacker to write files outside the intended extraction folder by supplying a crafted TAR, 7z, or RAR archive whose entry names such as ....//file bypass the app's non-recursive sanitizeEntryName filter and collapse to ../file. Exploitation requires the victim to manually extract the malicious archive in MP Manager, and the independent assessment limits impact to integrity (file creation or overwrite) on storage the app can write, with no confidentiality or availability impact. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the CVSS 4.0 base score is 6.7 in a moderate, non-urgent risk context.
Path traversal in Fossify File Manager through 1.6.2 allows a crafted ZIP archive to write files outside the chosen extraction folder by exploiting an unanchored startsWith check in DecompressActivity. Exploitation requires the victim to manually extract the malicious archive (UI:R, AV:L), limiting impact to file creation or overwrite in directories writable by the app; no public exploit code or active exploitation has been identified, and no authentication is required per the CVSS vector (PR:N).
Information disclosure in Microsoft Office for Android (versions 16.0.1 prior to 16.0.20430.20000) allows a locally authenticated attacker to read uninitialized memory from the graphics component, potentially exposing sensitive data. The vulnerability requires local, low-privileged access (PR:L) and no user interaction, with a CVSS 3.1 score of 5.5 (moderate severity). No public exploit code has been identified at time of analysis, and the issue is not known to be actively exploited; patching to version 16.0.20430.20000 or later resolves the flaw.
Path traversal (CWE-22) in the Document Intake component of Polaris Office App 9.9.19 on Android lets a local, low-privileged actor write files outside the application's designated temporary directory by supplying a crafted _display_name value to com.infraware.service.m.n.a. There is no remote or network vector - exploitation requires local access to the device plus the low-privilege ability to invoke the Document Intake function (CVSS 3.1 AV:L/PR:L/UI:N), and the assessed impact is limited to low integrity and low availability with no confidentiality disclosure. A public exploit has been released (publicly available exploit code exists), but the risk is low: the vendor shipped a fix in version 9.9.22 that adds path validation, and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis.
SHAREit for Android 6.27.38_ww exposes a dangerous JavaScript bridge routine (syncInvoke) that allows attacker-controlled web content rendered inside the app's WebView to invoke privileged native functionality, resulting in limited information disclosure. Exploitation is unauthenticated but requires the victim to open or load a malicious page within the app, as demonstrated by the publicly available '1-click.html' proof-of-concept; no confirmed active exploitation (CISA KEV) is reported. Given the low confidentiality-only impact and the user-interaction prerequisite, this is a moderate, lower-priority issue.
Local information disclosure in Samsung Internet lets an attacker who already has access to the device read sensitive data through an improper access control weakness in all versions prior to 30.0.5.6. Samsung rates it CVSS 4.0 5.9 (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N), and our independent assessment agrees: medium severity, local-only reach, confidentiality impact only, with no integrity or availability effect. No public exploit identified at time of analysis, so this is a moderate-priority patching item rather than an urgent one; the attack requires local access plus a specific precondition (AT:P) rather than working against every default invocation, but once met it needs no authentication or privileges (PR:N) and no user interaction (UI:N). Updating to 30.0.5.6 or later removes the flaw.
Samsung Internet versions prior to 30.0.5.24 are susceptible to script injection due to improper input validation, allowing unauthenticated remote attackers to compromise confidentiality of user data (CVSS 4.0 base 6.0). Exploitation requires passive user interaction (e.g., visiting a malicious page), and the assessed impact is limited to confidentiality (VC:H, VI:N, VA:N). The flaw was confirmed by Samsung's product security team; no public exploit has been identified at time of analysis.
Improper input validation in the CreditCardRetrieveActivity component of Samsung Checkout prior to version 5.1.03.1 allows a locally installed malicious application to launch arbitrary activities with Samsung Checkout's own privileges, resulting in low-severity information disclosure and integrity impact. Exploitation is not remote: the attacker must already have code executing on the device, typically through a sideloaded or otherwise installed malicious app, and must be able to pass crafted input to the affected activity. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and Samsung has shipped a fixed build (5.1.03.1) as documented in its mobile security bulletin.
Improper input validation in the GuestCreditCardRegisterActivity component of Samsung Checkout allows a malicious or malfunctioning app already installed on the same Samsung device to launch arbitrary activities with Samsung Checkout's privileges, giving limited unauthorized read and write impact (low confidentiality and integrity, no availability impact). Only Samsung Checkout builds prior to 5.1.03.1 are affected, and the flaw requires local on-device access from a separate app; it cannot be triggered remotely or over a network, and neither user interaction nor authentication is required once that local app is running. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the medium-severity rating (CVSS 4.0 base 5.1, assessed CVSS 3.1 5.1) reflects that the mandatory prerequisite of pre-existing local code execution substantially narrows realistic exposure.
Local attackers who can run code on a Samsung device can exploit improper input validation in Samsung Checkout's CreditCardRegisterActivity to launch arbitrary activities using Samsung Checkout's own privileges, yielding low-level confidentiality and integrity exposure. The flaw affects Samsung Checkout versions prior to 5.1.03.1 and requires local code execution on the device, but no additional authentication or user interaction (CVSS:4.0 AV:L/AC:L/PR:N/UI:N, score 5.1; independently assessed as CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; overall this is a medium-severity, locally-scoped issue with limited real-world urgency.
Samsung Account versions prior to 15.7.01.1 on Samsung Android devices expose an improperly exported application component that any other app installed on the same device can query to read sensitive account data. Exploitation requires a malicious or compromised local app already present on the device - there is no remote access, no user interaction, and no elevated privilege requirement per the CVSS vector (PR:N/UI:N) - making this a medium-severity local information-disclosure issue (CVSS 4.0 base 6.9). No public exploit code has been identified at time of analysis.
Out-of-bounds memory write in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows a local attacker to corrupt memory by supplying a crafted HEIF image to the cover-image decoding path. Only devices running builds prior to SMR Oct-2026 Release 1 are affected; the flaw is local (AV:L) but requires no privileges or user interaction once an app or process is present on the device, meaning a co-resident unprivileged application is sufficient. Impact is limited to integrity (no confidentiality or availability effect asserted), and no public exploit identified at time of analysis.
Local information disclosure in Samsung Locksettings (prior to SMR Oct-2026 Release 1) allows an attacker who already possesses root privilege on the device to read data belonging to a tied profile while the device is in the Before First Unlock (BFU) state. Exploitation is local-only (AV:L) and requires high privileges (PR:H), with no remote path; it does not enable privilege escalation, code execution, or data modification. No public exploit code exists, and the vulnerability is not listed in CISA KEV; EPSS data was not provided at time of analysis.
Out-of-bounds read and write in the native AI sound-separation library (lib_sag_ai_sound_sep_v2.00.so) on Samsung mobile devices allows a local, low-privileged attacker to read and write memory outside the intended buffer, with impact bounded to low confidentiality, integrity, and availability within the affected component. The flaw is only reachable by an attacker who already holds local code execution on the device - typically a malicious or compromised app capable of supplying crafted input to the library - and affects firmware versions prior to SMR Oct-2026 Release 1. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation; the moderate CVSS 4.8 score reflects the local attack vector and limited per-component impact rather than a remote or high-severity threat.
Local information disclosure in Samsung DownloadProvider allows an attacker-controlled Android application installed on a Samsung device to read files held in scoped storage that it should not be able to reach, yielding high confidentiality impact with only low integrity and availability impact. The flaw affects devices running firmware prior to the SMR Oct-2026 Release 1 maintenance release and requires no user interaction and no network access, because exploitation depends on a malicious app already running locally with low privileges. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, making this a moderate-risk, local-only issue rather than a remotely triggerable emergency.
Local information disclosure in Samsung's CocktailBarService allows a malicious or compromised app already running on a Galaxy device to access sensitive data without additional user interaction or authentication. The flaw requires local code execution (AV:L) and affects Samsung builds prior to SMR Oct-2026 Release 1; no public exploit code has been identified at the time of analysis, and the confidentiality impact is limited (C:L). This is a moderate, locally-exploitable issue rather than a remote or high-severity threat.
Out-of-bounds write in Samsung Android's libsmkvextractor.so media parsing library allows a local attacker to corrupt memory by supplying a crafted Matroska (MKV) file, resulting in low integrity and availability impact. Affected are Samsung devices running firmware prior to SMR Oct-2026 Release 1; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 base score is 5.1 (medium). The attacker requires local access but no special privileges, and the flaw does not compromise confidentiality or change scope.
Out-of-bounds write in Samsung Android's libcodec2-sec-flacdec.so FLAC decoder allows a local attacker to write memory beyond the intended buffer, degrading integrity and availability of the affected device process. The issue affects devices running firmware prior to SMR Oct-2026 Release 1, and exploitation requires local access plus the ability to push attacker-controlled FLAC data into the codec path, typically through a malicious or compromised app. There is no public exploit identified at time of analysis, and the vendor-assigned CVSS 4.0 base score of 5.1 (bounded to low integrity and low availability impact with no confidentiality loss) places this in routine monthly-patch priority rather than emergency response.
Path traversal in the Lippu Docx Reader / Office Viewer app up to version 1.4.5 on Android lets a remote, unauthenticated attacker influence file paths handled by the word.office.docxviewer.document.docx.reader.ViewTxt function by supplying a crafted '_display_name' value containing '../' sequences, potentially reading or altering files within the app sandbox. Exploitation is not autonomous: it requires the victim to open attacker-controlled document content (CVSS 4.0 UI:P, passive user interaction), and impact stays inside the application sandbox with no scope change, which is why our assessment rates this a medium-severity issue (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, CVSS 4.0 base 5.3) and a low real-world priority. There is no public exploit identified at time of analysis and no confirmed active exploitation; no vendor-released patch for version 1.4.5 was identified at time of analysis.
Information disclosure in ZTE Z80 Ultra allows a malicious or compromised third-party app installed on the device to invoke system interfaces through reflection and retrieve sensitive information, because those interfaces lack robust invocation authentication and access control. Exploitation is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), with confidentiality impact only and no integrity or availability effect. No public exploit identified at time of analysis; the issue is classified under CWE-269 and tagged as privilege escalation, but the assessed impact is a moderate, local-only information-disclosure flaw rather than a high-priority remote threat.
Information disclosure in ZTE Z80 Ultra (nubia Z80 Ultra) smartphones allows a local app to reflectively invoke a system interface that lacks the necessary access-control check and read otherwise-protected information, with no integrity or availability impact. The vendor rates this CVE-2026-108501 at CVSS 5.7 (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), while the independent assessment treats it as a local, unauthenticated information-disclosure issue (CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) that requires code execution on the device via an attacker-controlled app. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is confined to the ZTE Z80 Ultra model.
Improper handling of custom URL schemes in the Android application Ticket Ryutsu Center allows a malicious co-resident app on the same device to send a crafted Intent that causes the victim app to open an arbitrary website. Exploitation requires a separate attacker-controlled application to already be installed and depends on user interaction; impact is limited to low integrity violation with no code execution, data theft, or availability loss. No public exploit identified at time of analysis, and the issue is assessed as genuinely low priority.
Hard-coded credentials embedded in the Ticket Ryutsu Center Android application (wavedash_co.,_ltd.) let anyone who downloads the publicly available Google Play package recover an API key used by the app through static analysis or decompilation. The vector (AV:L/PR:N/UI:N) shows the only prerequisite is local access to the distributed binary, meaning the extraction requires neither authentication nor user interaction, though the real-world blast radius depends entirely on the backend scope and permissions conferred by that key, which the JVN advisory does not document. Impact is therefore scored as limited confidentiality disclosure (CVSS 4.0, C:L/I:N/A:N per the independent assessment, which matches the NVD vector for this unauthenticated local-access flaw); no public exploit code and no confirmed active exploitation were identified at time of analysis.
Path traversal in Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 lets a locally installed malicious app with no requested permissions write attacker-controlled files into Jabber's private application data directories. The attacker sends a crafted shared content:// URI to Jabber's exported crosslaunch.share activity whose unsanitized ContentProvider display name contains '../' sequences; because that display name is used directly in file-path construction, files can be planted in databases/, shared_prefs/, no_backup/, and files/ with no user interaction. Impact is integrity-only and confined to Jabber's own sandbox (CVSS v4.0 5.1, AV:L/PR:N/UI:N/VC:N/VI:L/VA:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is local - the adversary must already have code executing on the device.
Unauthenticated command injection in the Fanvil X7A IP phone's web management portal (firmware 2.6.0.1182) lets any attacker who can reach the diagnostic ping tool execute arbitrary commands with the privileges of the underlying Android operating system, resulting in total device compromise (CVSS 10.0, scope-changed, S:C). No credentials or user interaction are required (PR:N/UI:N), publicly available exploit code exists, and CISA's SSVC assessment rates the flaw fully automatable with total technical impact, so any deployment with the portal reachable from untrusted or flat networks should be assumed exploitable at scale. In correctly segmented environments the real-world attacker population is limited to hosts with management-VLAN or LAN reachability to the phone's portal.
Unauthenticated command injection in the Fanvil x7a IP phone's web management portal (firmware 2.6.0.1182) allows any attacker who can reach the portal's diagnostic ping tool to inject shell metacharacters and execute arbitrary commands on the underlying Android operating system, compromising confidentiality, integrity and availability equally (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The practical gating factor is exposure: the portal is normally reachable only from a LAN or management VLAN, so risk falls sharply wherever it is not reachable from untrusted networks. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis - CISA's SSVC rates Exploitation as 'none' while classifying the flaw as automatable with total technical impact, meaning exploitation could spread quickly once a proof-of-concept surfaces.
UI spoofing in the Autofill AI component of Google Chrome for Android lets a remote, unauthenticated attacker deceive users with fabricated interface elements rendered from a crafted HTML page, and only Android builds prior to 155.0.8059.39 are affected (desktop and other platform builds are not identified as impacted). Exploitation requires the victim to load and engage with the attacker's page, and no public exploit code has been identified at time of analysis; the vendor rates the Chromium severity as Low and scores the base vector 5.4 (AV:N/AC:L/PR:N/UI:R), though our read of the impact is narrower - deception of the user rather than code execution or direct data exfiltration. A vendor patch shipped in Chrome 155.0.8059.39, so this is best handled as a low-priority, routine update rather than an emergency.
UI misrepresentation in Google Chrome for Android before 155.0.8059.39 lets a remote attacker spoof browser interface elements by luring a victim to a crafted HTML page, potentially tricking the user into trusting falsified prompts, address-bar-like graphics, or permission dialogs rendered inside the page. The flaw is limited to the Android Chrome client and requires mandatory user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N per our independent assessment, CWE-451), so no authentication, privileges, or code execution are involved; Google rates it Chromium security severity Low. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none with automatable: no, and vendor-released patches are available, making this a low-priority issue despite the mid-range base score reported by some sources.
UI misrepresentation in Google Chrome for Android before 155.0.8059.39 lets a remote attacker spoof trusted browser interface elements by getting a victim to open a crafted HTML page, which can mislead the user about which site, prompt, or state they are actually interacting with. Exploitation is unauthenticated (CVSS PR:N) but hinges on user interaction (UI:R) - the victim must actively navigate to the attacker-controlled page - and the assessed impact is limited to low confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), meaning no code execution, no data integrity change, and no denial of service; this aligns with Chromium's own Low security severity for the issue and with CISA SSVC's rating of no exploitation, non-automatable, and partial technical impact. Vendor patches are available in Chrome 155.0.8059.39, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Google Chrome for Android versions prior to 155.0.8059.39 lets a remote attacker read a limited amount of GPU process memory outside the browser sandbox by convincing a user to open a crafted HTML page. Exploitation requires user interaction (the victim must navigate to the malicious page) and yields only a partial read of uninitialized memory - no code execution, data modification, or denial of service - which is why Google rates it Chromium severity Low and our assessment scores it CVSS 4.7. There is no confirmed active exploitation and no public exploit identified at time of analysis, and exploitation likelihood is low (EPSS 0.19%, 8th percentile); a vendor patch is available in Chrome 155.0.8059.39 and later.
UI misrepresentation in Google Chrome on Android before 155.0.8059.39 lets a remote attacker spoof the address bar through a crafted HTML page that abuses the FullScreen feature. Exploitation requires the victim to navigate to the malicious page and enter fullscreen (UI:R), and it only yields low confidentiality impact with no code execution or authentication bypass; it is not confirmed actively exploited, no public exploit code has been identified, and vendor patch 155.0.8059.39 is available.
Address-bar spoofing in Google Chrome for Android (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker misrepresent the browser UI through the Picture-in-Picture code path, so that a crafted HTML page can make the displayed address bar show a false origin. Exploitation requires the victim to navigate to the attacker's page and be deceived by the spoofed UI (UI:R); the flaw yields UI deception only and cannot execute code, read data, or persist. No public exploit identified at time of analysis and no CISA KEV listing; a vendor patch (155.0.8059.39) was available at release, making this a low-priority issue despite the moderate 5.4 CVSS published by NVD, which our assessment narrows to integrity impact alone.
Local information disclosure in Google Chrome on Android versions prior to 155.0.8059.39 allows a co-installed malicious app to access sensitive information without user interaction or authentication, though exploitation requires high attack complexity and the pre-existence of an attacker-controlled app on the same device. This moderate-severity issue (CVSS 5.1) has no public exploit identified at time of analysis, and vendor patch 155.0.8059.39 is available.
UI spoofing in Google Chrome on Android (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker misrepresent browser UI elements by luring a victim to a crafted HTML page, which can be used to make spoofed origins or prompts look trustworthy. Exploitation requires the user to actively navigate to the attacker-controlled page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), and the resulting harm is limited to user deception rather than code execution or direct data theft. There is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with low automability, consistent with the low-to-moderate EPSS-style risk profile of a Medium-severity Chromium UI bug.
Out-of-sandbox memory disclosure affects Google Chrome on Android builds prior to 155.0.8059.39, where an uninitialized resource in Dawn, Chrome's WebGPU implementation, can be triggered by a crafted HTML page to leak memory contents. Exploitation is constrained: it requires the victim to open attacker-influenced content that exercises WebGPU (user interaction is mandatory, UI:R) and yields only a LOW-confidentiality read with no integrity or availability impact, giving a CVSS 3.1 base score of 4.7 and EPSS of just 0.19% (8th percentile). No public exploit code has been identified at time of analysis, this CVE is not on CISA KEV, and a vendor patch is available in Chrome 155.0.8059.39.
UI spoofing in Google Chrome on Android (versions prior to 155.0.8059.39) stems from incorrect authorization handling in the WebShare feature and allows a remote attacker who has already compromised the renderer process to spoof UI elements via a crafted HTML page that the victim must interact with. The assessed impact is limited to integrity spoofing (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N), with no confidentiality or availability impact, and no public exploit identified at time of analysis. Exploitation is gated by the non-default prerequisite of a compromised renderer plus required user interaction, making this a low-priority issue despite the medium Chromium severity label.
Incorrect reference resolution in the Offline component of Google Chrome on Android before 155.0.8059.39 allows an attacker to obtain sensitive information from beyond the renderer's own data. Exploitation is not autonomous: it requires that the attacker has already compromised the Chrome renderer process on the Android device and that the victim loads a crafted HTML page, which is why the assessed vector carries high attack complexity (AC:H) and a user-interaction requirement (UI:R) despite network reachability. Impact is limited to confidentiality with no integrity or availability effect, no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as "none" and the issue as not automatable, making this a defense-in-depth fix rather than a frontline emergency. A vendor patch is available and the issue is tracked as EUVD-2026-93741 and in the Chromium issue tracker.
UI spoofing in Google Chrome on Android before 155.0.8059.39 allows a remote, unauthenticated attacker to render deceptive Messages interface elements from a crafted HTML page, tricking a victim who has been socially engineered into interacting with the spoofed content. Successful exploitation requires the victim to actively open the attacker's page and then engage with the fake UI (UI:R), and the resulting impact is limited to Low confidentiality - there is no code execution, memory corruption, or data exfiltration path described. There is no public exploit identified at time of analysis and no CISA KEV listing; Chromium rates the issue Medium, and the affected scope appears confined to the Android build of Chrome, with desktop and other platforms not indicated.
Incorrect authorization in Google Chrome's built-in PDF handling on Android (versions prior to 155.0.8059.39) allows a malicious application already co-installed on the same device to obtain sensitive information after the victim is socially engineered into interacting with a crafted PDF. The issue is unauthenticated from a credentials standpoint (CVSS PR:N) but is effectively local in nature: it cannot be triggered purely remotely, it depends on the attacker first getting a separate app onto the device, it requires victim interaction, and its impact is confined to confidentiality with no integrity or availability effect. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and Chromium rates the issue Medium severity; the signals point to a genuine but low-urgency issue rather than a top priority, though a vendor patch is available and should be applied through normal update cycles.
Cross-site request forgery in the ReadingList feature of Google Chrome for Android (versions prior to 155.0.8059.39) allows a remote attacker to bypass web origin policy by social-engineering a victim into loading a crafted HTML page. Exploitation requires user interaction (UI:R) and is limited to the Android platform; no public exploit code has been identified and the EPSS score is low at 0.18% (7th percentile). Google has released a patched version (155.0.8059.39), and the issue is rated medium severity by Chromium.
Web origin policy bypass in Google Chrome for Android (versions prior to 155.0.8059.39) lets a local attacker using a co-installed app escape the browser's same-origin restrictions by winning a race condition in the Custom Tabs component. Exploitation is not remote: per the assessed vector (AV:L/AC:H/PR:L/UI:R) the attacker must already have a malicious app installed on the same device (low privileges, PR:L) and must rely on victim user interaction, typically opening a link that launches a Custom Tab. There is no CISA KEV entry and no public exploit identified at time of analysis, and EPSS is negligible at 0.09% (percentile 0%), so this is a moderate-priority hardening issue rather than an urgent one.
Authentication and access-control bypass in Google Chrome on Android before version 155.0.8059.39 lets a malicious app already installed on the same device act as a confused deputy, driving Chrome's UI into a privileged page and circumventing system access restrictions. The flaw is local-only (AV:L) and requires the attacker to first get their app onto the victim's device via sideloading or a trojanized application, after which no further interaction with Chrome is needed (UI:N); impact is limited to partial confidentiality and integrity loss with no availability impact (CVSS 4.4). There is confirmed vendor patching but no public exploit identified at time of analysis and no CISA KEV listing, and EPSS is negligible (0.11%, 1st percentile), ranking this as a low-to-moderate, local-only issue rather than an urgent priority.
Information disclosure in Google Chrome on Android before 155.0.8059.39 allows a remote attacker who has already compromised the renderer process to read memory outside the GPU sandbox by serving a crafted HTML page. The flaw (CWE-908, use of an uninitialized resource in the GPU path) is a chain-dependent bug rather than a standalone entry point: it requires a separate renderer compromise plus victim interaction to load malicious content, and the impact stops at memory disclosure with no code execution, integrity, or availability loss. No public exploit has been identified at time of analysis, EPSS is low at 0.24 percent (13th percentile), and Google has released a fix in Chrome 155.0.8059.39 at Chromium severity Medium.
Android versions up to 14.0 contains a vulnerability that allows attackers to local escalation of privilege with no additional execution privileges needed (CVSS 8.4).
Android versions up to 14.0 is affected by authorization bypass through user-controlled key (CVSS 8.4).
Android versions up to 14.0 is affected by improper restriction of rendered ui layers or frames (CVSS 8.6).
Android has a heap buffer overflow in multiple locations enabling privilege escalation through out-of-bounds read and write operations.
Local privilege escalation in Android's PCIe driver allows system-level attackers to execute arbitrary code through an out-of-bounds write caused by insufficient bounds validation. Exploitation requires pre-existing system privileges but no user interaction, enabling a compromised system component to gain complete device control. No patch is currently available.
Remote control vulnerability in Unitree Go2 robot dog firmware 1.1.7-1.1.11. The companion Android app allows remote attackers to take control of the robot. PoC available.
Missing bounds check in Android VPU (Video Processing Unit) driver's vpu_mmap allows arbitrary address memory mapping, potentially leading to local privilege escalation on Android devices.
Android versions up to 14.0 contains a vulnerability that allows attackers to launch arbitrary activity with Samsung Dialer privilege (CVSS 7.8).
Android versions up to 15.0 contains a vulnerability that allows attackers to launch arbitrary activity with Settings privilege (CVSS 7.8).
The Android cameraisp component contains an out-of-bounds write vulnerability due to insufficient bounds validation, enabling privilege escalation for attackers who have already gained system-level access. No user interaction is required for exploitation, and the vulnerability affects confidentiality, integrity, and availability of the device. No patch is currently available.
A use-after-free vulnerability in Android's cameraisp component allows privilege escalation to local denial of service for attackers with system-level access, requiring no user interaction. The flaw enables malicious actors to manipulate memory safety boundaries and execute arbitrary actions within the camera service context. No patch is currently available for this vulnerability.
An out-of-bounds write vulnerability in Android's imgsys component allows a local attacker with system-level privileges to escalate permissions and gain complete control over the device due to insufficient bounds checking. The vulnerability requires no user interaction and cannot be patched in current versions. This affects Android devices where an attacker has already obtained elevated system access.
MobSF versions prior to 4.4.5 are vulnerable to stored XSS through unsanitized rendering of Android manifest attributes in HTML reports, allowing attackers to inject malicious JavaScript by uploading crafted APK files. Public exploit code exists for this vulnerability, and successful exploitation enables session hijacking and account takeover of security analysts using the framework. Upgrade to version 4.4.5 or later to remediate.
Chrome for Android prior to 144.0.7559.59 has a security UI spoofing vulnerability that allows remote attackers to display misleading security indicators.
Arbitrary code execution in the Android PROCA driver before the January 2026 security update results from a use-after-free vulnerability accessible to local attackers with basic privileges. An attacker with local access can exploit this memory safety flaw to execute arbitrary code with elevated privileges on affected devices. No patch is currently available for this high-severity vulnerability.
Android versions up to 15.0 contains a vulnerability that allows attackers to execute the privileged APIs (CVSS 7.8).
Remote code execution in Samsung Android's Quram image codec (libimagecodec.quram.so) allows unauthenticated attackers to execute arbitrary code on affected devices running Android 13.0 with SMR levels prior to Sep-2025 Release 1 by supplying a crafted image. This is confirmed actively exploited (CISA KEV), and exploitation requires no authentication or user interaction, though the malicious image must reach an auto-decoding path such as messaging previews or thumbnail generation; code execution occurs in the context of the invoking component. EPSS is 4.91% (90th percentile), indicating elevated risk, and the CVSS is 9.8.
Remote code execution in Samsung Android 13's Quram image codec (libimagecodec.quram.so) allows unauthenticated, zero-click attackers to corrupt memory by having the device decode a crafted image, per the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector scoring 9.8. The flaw is confirmed actively exploited (CISA KEV) and was observed in the wild as part of the LANDFALL commercial-grade Android spyware chain, with EPSS at 1.84% (83rd percentile) - low in absolute terms but elevated in rank, consistent with targeted rather than mass exploitation. Only devices running Samsung Android 13 builds with security patch levels prior to SMR Apr-2025 Release 1 are affected, and exploitation in the wild has been selective, so the primary exposure driver is unpatched devices still receiving/dismissing images through messaging and media pipelines.
Android Chrome sandbox contains a use-after-free enabling sandbox escape and local privilege escalation to attack the Android system_server process.
In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due to incorrect unicode normalization. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity.
there is a possible way to bypass due to a logic error in the code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
there is a possible way to bypass due to a logic error in the code. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
there is a possible Information Disclosure due to uninitialized data. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.
In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or insufficient UI. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Kernel pointers are printed in the log file prior to SMR May-2023 Release 1 allows a privileged local attacker to bypass ASLR. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
In WorkSource, there is a possible parcel mismatch. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.
In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. Rated medium severity (CVSS 6.4). No vendor patch available.
Assuming radio permission is gained, missing input validation in modem interface driver prior to SMR Oct-2021 Release 1 results in format string bug leading to kernel panic. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Lack of boundary checking of a buffer in set_skb_priv() of modem interface driver prior to SMR Oct-2021 Release 1 allows OOB read and it results in arbitrary code execution by dereference of invalid. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows local attackers to bypass signature check given a radio privilege is compromised. Rated medium severity (CVSS 6.4). No vendor patch available.
A use after free vulnerability via race condition in MFC charger driver prior to SMR MAY-2021 Release 1 allows arbitrary write given a radio privilege is compromised. Rated medium severity (CVSS 6.4). No vendor patch available.
An improper boundary check in DSP driver prior to SMR Mar-2021 Release 1 allows out of bounds memory access. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
A vulnerability in DSP driver prior to SMR Mar-2021 Release 1 allows attackers load arbitrary ELF libraries inside DSP. Rated medium severity (CVSS 6.7), this vulnerability is low attack complexity. No vendor patch available.
An incorrect implementation handling file descriptor in dpu driver prior to SMR Mar-2021 Release 1 results in memory corruption leading to kernel panic. Rated medium severity (CVSS 4.4), this vulnerability is low attack complexity. No vendor patch available.
An improper access control vulnerability in sec_log file prior to SMR MAR-2021 Release 1 exposes sensitive kernel information to userspace. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Improper access control in clipboard service in Samsung mobile devices prior to SMR Mar-2021 Release 1 allows untrusted applications to read or write certain local files. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
In the ioctl handlers of the Mediatek Command Queue driver, there is a possible out of bounds write due to insufficient input sanitization and missing SELinux restrictions. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.
A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available.
An elevation of privilege vulnerability in the Android system (art). Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 59.7%.
Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 87.0%.
Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before 18.0.0.143 on OS X. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 90.3%.
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 76.4%.
Information disclosure in the Vehicle Inspection Certificate Viewer mobile application for Android and iOS causes the app to include API integration credentials - an access ID and an access key - inside the data it transmits, so anyone who can observe or intercept that client-server traffic can recover the credentials. Both platform editions are listed as affected with no version constraint (CPE wildcards for the Android and iOS builds), and the vendor advisory (JVN#94004488, reported to JPCERT) does not identify a fixed release. Exploitation is not trivial: it requires an attacker to obtain a network vantage point such as a man-in-the-middle position on the app's communication path, and there is no public exploit identified at time of analysis; with CVSS 5.3 (C:L/I:N/A:N) the practical impact depends on what the leaked credentials authorize.
Intent redirection and improper access control in the AgentWeb Android WebView library (agentweb-core through 5.1.6-androidx) lets attacker-influenced web content loaded inside a host app's WebView launch that host app's own non-exported components and coerce URI permission grants for the host's ContentProviders by supplying crafted intent:// URLs that DefaultWebClient parses and fires under the host Activity's identity. The vulnerability is exploitable unauthenticated and remotely with no user interaction beyond the app rendering untrusted content (assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), although real impact is bounded by the host app's own component and provider surface and by the host exposing sensitive non-exported components or providers; components belonging to other applications remain gated by the OS exported check. No public exploit identified at time of analysis, and the project has released a fixed version, 5.1.7-androidx, via commit 9efb1519.
Path traversal in MP Manager through 1.1.0 allows a local attacker to write files outside the intended extraction folder by supplying a crafted TAR, 7z, or RAR archive whose entry names such as ....//file bypass the app's non-recursive sanitizeEntryName filter and collapse to ../file. Exploitation requires the victim to manually extract the malicious archive in MP Manager, and the independent assessment limits impact to integrity (file creation or overwrite) on storage the app can write, with no confidentiality or availability impact. Publicly available exploit code exists, but there is no CISA KEV confirmation of active exploitation, and the CVSS 4.0 base score is 6.7 in a moderate, non-urgent risk context.
Path traversal in Fossify File Manager through 1.6.2 allows a crafted ZIP archive to write files outside the chosen extraction folder by exploiting an unanchored startsWith check in DecompressActivity. Exploitation requires the victim to manually extract the malicious archive (UI:R, AV:L), limiting impact to file creation or overwrite in directories writable by the app; no public exploit code or active exploitation has been identified, and no authentication is required per the CVSS vector (PR:N).
Information disclosure in Microsoft Office for Android (versions 16.0.1 prior to 16.0.20430.20000) allows a locally authenticated attacker to read uninitialized memory from the graphics component, potentially exposing sensitive data. The vulnerability requires local, low-privileged access (PR:L) and no user interaction, with a CVSS 3.1 score of 5.5 (moderate severity). No public exploit code has been identified at time of analysis, and the issue is not known to be actively exploited; patching to version 16.0.20430.20000 or later resolves the flaw.
Path traversal (CWE-22) in the Document Intake component of Polaris Office App 9.9.19 on Android lets a local, low-privileged actor write files outside the application's designated temporary directory by supplying a crafted _display_name value to com.infraware.service.m.n.a. There is no remote or network vector - exploitation requires local access to the device plus the low-privilege ability to invoke the Document Intake function (CVSS 3.1 AV:L/PR:L/UI:N), and the assessed impact is limited to low integrity and low availability with no confidentiality disclosure. A public exploit has been released (publicly available exploit code exists), but the risk is low: the vendor shipped a fix in version 9.9.22 that adds path validation, and the issue is not listed as confirmed actively exploited (CISA KEV) at time of analysis.
SHAREit for Android 6.27.38_ww exposes a dangerous JavaScript bridge routine (syncInvoke) that allows attacker-controlled web content rendered inside the app's WebView to invoke privileged native functionality, resulting in limited information disclosure. Exploitation is unauthenticated but requires the victim to open or load a malicious page within the app, as demonstrated by the publicly available '1-click.html' proof-of-concept; no confirmed active exploitation (CISA KEV) is reported. Given the low confidentiality-only impact and the user-interaction prerequisite, this is a moderate, lower-priority issue.
Local information disclosure in Samsung Internet lets an attacker who already has access to the device read sensitive data through an improper access control weakness in all versions prior to 30.0.5.6. Samsung rates it CVSS 4.0 5.9 (AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N), and our independent assessment agrees: medium severity, local-only reach, confidentiality impact only, with no integrity or availability effect. No public exploit identified at time of analysis, so this is a moderate-priority patching item rather than an urgent one; the attack requires local access plus a specific precondition (AT:P) rather than working against every default invocation, but once met it needs no authentication or privileges (PR:N) and no user interaction (UI:N). Updating to 30.0.5.6 or later removes the flaw.
Samsung Internet versions prior to 30.0.5.24 are susceptible to script injection due to improper input validation, allowing unauthenticated remote attackers to compromise confidentiality of user data (CVSS 4.0 base 6.0). Exploitation requires passive user interaction (e.g., visiting a malicious page), and the assessed impact is limited to confidentiality (VC:H, VI:N, VA:N). The flaw was confirmed by Samsung's product security team; no public exploit has been identified at time of analysis.
Improper input validation in the CreditCardRetrieveActivity component of Samsung Checkout prior to version 5.1.03.1 allows a locally installed malicious application to launch arbitrary activities with Samsung Checkout's own privileges, resulting in low-severity information disclosure and integrity impact. Exploitation is not remote: the attacker must already have code executing on the device, typically through a sideloaded or otherwise installed malicious app, and must be able to pass crafted input to the affected activity. There is no confirmed active exploitation and no public exploit code identified at time of analysis, and Samsung has shipped a fixed build (5.1.03.1) as documented in its mobile security bulletin.
Improper input validation in the GuestCreditCardRegisterActivity component of Samsung Checkout allows a malicious or malfunctioning app already installed on the same Samsung device to launch arbitrary activities with Samsung Checkout's privileges, giving limited unauthorized read and write impact (low confidentiality and integrity, no availability impact). Only Samsung Checkout builds prior to 5.1.03.1 are affected, and the flaw requires local on-device access from a separate app; it cannot be triggered remotely or over a network, and neither user interaction nor authentication is required once that local app is running. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); the medium-severity rating (CVSS 4.0 base 5.1, assessed CVSS 3.1 5.1) reflects that the mandatory prerequisite of pre-existing local code execution substantially narrows realistic exposure.
Local attackers who can run code on a Samsung device can exploit improper input validation in Samsung Checkout's CreditCardRegisterActivity to launch arbitrary activities using Samsung Checkout's own privileges, yielding low-level confidentiality and integrity exposure. The flaw affects Samsung Checkout versions prior to 5.1.03.1 and requires local code execution on the device, but no additional authentication or user interaction (CVSS:4.0 AV:L/AC:L/PR:N/UI:N, score 5.1; independently assessed as CVSS:3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; overall this is a medium-severity, locally-scoped issue with limited real-world urgency.
Samsung Account versions prior to 15.7.01.1 on Samsung Android devices expose an improperly exported application component that any other app installed on the same device can query to read sensitive account data. Exploitation requires a malicious or compromised local app already present on the device - there is no remote access, no user interaction, and no elevated privilege requirement per the CVSS vector (PR:N/UI:N) - making this a medium-severity local information-disclosure issue (CVSS 4.0 base 6.9). No public exploit code has been identified at time of analysis.
Out-of-bounds memory write in Samsung's HEIF decoder library (libsimba.heifdec.media.samsung.so) allows a local attacker to corrupt memory by supplying a crafted HEIF image to the cover-image decoding path. Only devices running builds prior to SMR Oct-2026 Release 1 are affected; the flaw is local (AV:L) but requires no privileges or user interaction once an app or process is present on the device, meaning a co-resident unprivileged application is sufficient. Impact is limited to integrity (no confidentiality or availability effect asserted), and no public exploit identified at time of analysis.
Local information disclosure in Samsung Locksettings (prior to SMR Oct-2026 Release 1) allows an attacker who already possesses root privilege on the device to read data belonging to a tied profile while the device is in the Before First Unlock (BFU) state. Exploitation is local-only (AV:L) and requires high privileges (PR:H), with no remote path; it does not enable privilege escalation, code execution, or data modification. No public exploit code exists, and the vulnerability is not listed in CISA KEV; EPSS data was not provided at time of analysis.
Out-of-bounds read and write in the native AI sound-separation library (lib_sag_ai_sound_sep_v2.00.so) on Samsung mobile devices allows a local, low-privileged attacker to read and write memory outside the intended buffer, with impact bounded to low confidentiality, integrity, and availability within the affected component. The flaw is only reachable by an attacker who already holds local code execution on the device - typically a malicious or compromised app capable of supplying crafted input to the library - and affects firmware versions prior to SMR Oct-2026 Release 1. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation; the moderate CVSS 4.8 score reflects the local attack vector and limited per-component impact rather than a remote or high-severity threat.
Local information disclosure in Samsung DownloadProvider allows an attacker-controlled Android application installed on a Samsung device to read files held in scoped storage that it should not be able to reach, yielding high confidentiality impact with only low integrity and availability impact. The flaw affects devices running firmware prior to the SMR Oct-2026 Release 1 maintenance release and requires no user interaction and no network access, because exploitation depends on a malicious app already running locally with low privileges. No public exploit code has been identified at time of analysis and the flaw is not confirmed as actively exploited, making this a moderate-risk, local-only issue rather than a remotely triggerable emergency.
Local information disclosure in Samsung's CocktailBarService allows a malicious or compromised app already running on a Galaxy device to access sensitive data without additional user interaction or authentication. The flaw requires local code execution (AV:L) and affects Samsung builds prior to SMR Oct-2026 Release 1; no public exploit code has been identified at the time of analysis, and the confidentiality impact is limited (C:L). This is a moderate, locally-exploitable issue rather than a remote or high-severity threat.
Out-of-bounds write in Samsung Android's libsmkvextractor.so media parsing library allows a local attacker to corrupt memory by supplying a crafted Matroska (MKV) file, resulting in low integrity and availability impact. Affected are Samsung devices running firmware prior to SMR Oct-2026 Release 1; no public exploit code or active exploitation has been identified at time of analysis, and the CVSS 4.0 base score is 5.1 (medium). The attacker requires local access but no special privileges, and the flaw does not compromise confidentiality or change scope.
Out-of-bounds write in Samsung Android's libcodec2-sec-flacdec.so FLAC decoder allows a local attacker to write memory beyond the intended buffer, degrading integrity and availability of the affected device process. The issue affects devices running firmware prior to SMR Oct-2026 Release 1, and exploitation requires local access plus the ability to push attacker-controlled FLAC data into the codec path, typically through a malicious or compromised app. There is no public exploit identified at time of analysis, and the vendor-assigned CVSS 4.0 base score of 5.1 (bounded to low integrity and low availability impact with no confidentiality loss) places this in routine monthly-patch priority rather than emergency response.
Path traversal in the Lippu Docx Reader / Office Viewer app up to version 1.4.5 on Android lets a remote, unauthenticated attacker influence file paths handled by the word.office.docxviewer.document.docx.reader.ViewTxt function by supplying a crafted '_display_name' value containing '../' sequences, potentially reading or altering files within the app sandbox. Exploitation is not autonomous: it requires the victim to open attacker-controlled document content (CVSS 4.0 UI:P, passive user interaction), and impact stays inside the application sandbox with no scope change, which is why our assessment rates this a medium-severity issue (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, CVSS 4.0 base 5.3) and a low real-world priority. There is no public exploit identified at time of analysis and no confirmed active exploitation; no vendor-released patch for version 1.4.5 was identified at time of analysis.
Information disclosure in ZTE Z80 Ultra allows a malicious or compromised third-party app installed on the device to invoke system interfaces through reflection and retrieve sensitive information, because those interfaces lack robust invocation authentication and access control. Exploitation is local and requires user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), with confidentiality impact only and no integrity or availability effect. No public exploit identified at time of analysis; the issue is classified under CWE-269 and tagged as privilege escalation, but the assessed impact is a moderate, local-only information-disclosure flaw rather than a high-priority remote threat.
Information disclosure in ZTE Z80 Ultra (nubia Z80 Ultra) smartphones allows a local app to reflectively invoke a system interface that lacks the necessary access-control check and read otherwise-protected information, with no integrity or availability impact. The vendor rates this CVE-2026-108501 at CVSS 5.7 (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N), while the independent assessment treats it as a local, unauthenticated information-disclosure issue (CVSS 3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) that requires code execution on the device via an attacker-controlled app. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is confined to the ZTE Z80 Ultra model.
Improper handling of custom URL schemes in the Android application Ticket Ryutsu Center allows a malicious co-resident app on the same device to send a crafted Intent that causes the victim app to open an arbitrary website. Exploitation requires a separate attacker-controlled application to already be installed and depends on user interaction; impact is limited to low integrity violation with no code execution, data theft, or availability loss. No public exploit identified at time of analysis, and the issue is assessed as genuinely low priority.
Hard-coded credentials embedded in the Ticket Ryutsu Center Android application (wavedash_co.,_ltd.) let anyone who downloads the publicly available Google Play package recover an API key used by the app through static analysis or decompilation. The vector (AV:L/PR:N/UI:N) shows the only prerequisite is local access to the distributed binary, meaning the extraction requires neither authentication nor user interaction, though the real-world blast radius depends entirely on the backend scope and permissions conferred by that key, which the JVN advisory does not document. Impact is therefore scored as limited confidentiality disclosure (CVSS 4.0, C:L/I:N/A:N per the independent assessment, which matches the NVD vector for this unauthenticated local-access flaw); no public exploit code and no confirmed active exploitation were identified at time of analysis.
Path traversal in Cisco Jabber for Android (com.cisco.im) before 15.3.1.311364 lets a locally installed malicious app with no requested permissions write attacker-controlled files into Jabber's private application data directories. The attacker sends a crafted shared content:// URI to Jabber's exported crosslaunch.share activity whose unsanitized ContentProvider display name contains '../' sequences; because that display name is used directly in file-path construction, files can be planted in databases/, shared_prefs/, no_backup/, and files/ with no user interaction. Impact is integrity-only and confined to Jabber's own sandbox (CVSS v4.0 5.1, AV:L/PR:N/UI:N/VC:N/VI:L/VA:N); no public exploit code and no confirmed active exploitation were identified at time of analysis, and the attack surface is local - the adversary must already have code executing on the device.
Unauthenticated command injection in the Fanvil X7A IP phone's web management portal (firmware 2.6.0.1182) lets any attacker who can reach the diagnostic ping tool execute arbitrary commands with the privileges of the underlying Android operating system, resulting in total device compromise (CVSS 10.0, scope-changed, S:C). No credentials or user interaction are required (PR:N/UI:N), publicly available exploit code exists, and CISA's SSVC assessment rates the flaw fully automatable with total technical impact, so any deployment with the portal reachable from untrusted or flat networks should be assumed exploitable at scale. In correctly segmented environments the real-world attacker population is limited to hosts with management-VLAN or LAN reachability to the phone's portal.
Unauthenticated command injection in the Fanvil x7a IP phone's web management portal (firmware 2.6.0.1182) allows any attacker who can reach the portal's diagnostic ping tool to inject shell metacharacters and execute arbitrary commands on the underlying Android operating system, compromising confidentiality, integrity and availability equally (CVSS 9.8, AV:N/AC:L/PR:N/UI:N). The practical gating factor is exposure: the portal is normally reachable only from a LAN or management VLAN, so risk falls sharply wherever it is not reachable from untrusted networks. No public exploit code or confirmed in-the-wild activity has been identified at time of analysis - CISA's SSVC rates Exploitation as 'none' while classifying the flaw as automatable with total technical impact, meaning exploitation could spread quickly once a proof-of-concept surfaces.
UI spoofing in the Autofill AI component of Google Chrome for Android lets a remote, unauthenticated attacker deceive users with fabricated interface elements rendered from a crafted HTML page, and only Android builds prior to 155.0.8059.39 are affected (desktop and other platform builds are not identified as impacted). Exploitation requires the victim to load and engage with the attacker's page, and no public exploit code has been identified at time of analysis; the vendor rates the Chromium severity as Low and scores the base vector 5.4 (AV:N/AC:L/PR:N/UI:R), though our read of the impact is narrower - deception of the user rather than code execution or direct data exfiltration. A vendor patch shipped in Chrome 155.0.8059.39, so this is best handled as a low-priority, routine update rather than an emergency.
UI misrepresentation in Google Chrome for Android before 155.0.8059.39 lets a remote attacker spoof browser interface elements by luring a victim to a crafted HTML page, potentially tricking the user into trusting falsified prompts, address-bar-like graphics, or permission dialogs rendered inside the page. The flaw is limited to the Android Chrome client and requires mandatory user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N per our independent assessment, CWE-451), so no authentication, privileges, or code execution are involved; Google rates it Chromium security severity Low. No public exploit code has been identified at time of analysis, CISA SSVC records exploitation as none with automatable: no, and vendor-released patches are available, making this a low-priority issue despite the mid-range base score reported by some sources.
UI misrepresentation in Google Chrome for Android before 155.0.8059.39 lets a remote attacker spoof trusted browser interface elements by getting a victim to open a crafted HTML page, which can mislead the user about which site, prompt, or state they are actually interacting with. Exploitation is unauthenticated (CVSS PR:N) but hinges on user interaction (UI:R) - the victim must actively navigate to the attacker-controlled page - and the assessed impact is limited to low confidentiality loss (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), meaning no code execution, no data integrity change, and no denial of service; this aligns with Chromium's own Low security severity for the issue and with CISA SSVC's rating of no exploitation, non-automatable, and partial technical impact. Vendor patches are available in Chrome 155.0.8059.39, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Information disclosure in Google Chrome for Android versions prior to 155.0.8059.39 lets a remote attacker read a limited amount of GPU process memory outside the browser sandbox by convincing a user to open a crafted HTML page. Exploitation requires user interaction (the victim must navigate to the malicious page) and yields only a partial read of uninitialized memory - no code execution, data modification, or denial of service - which is why Google rates it Chromium severity Low and our assessment scores it CVSS 4.7. There is no confirmed active exploitation and no public exploit identified at time of analysis, and exploitation likelihood is low (EPSS 0.19%, 8th percentile); a vendor patch is available in Chrome 155.0.8059.39 and later.
UI misrepresentation in Google Chrome on Android before 155.0.8059.39 lets a remote attacker spoof the address bar through a crafted HTML page that abuses the FullScreen feature. Exploitation requires the victim to navigate to the malicious page and enter fullscreen (UI:R), and it only yields low confidentiality impact with no code execution or authentication bypass; it is not confirmed actively exploited, no public exploit code has been identified, and vendor patch 155.0.8059.39 is available.
Address-bar spoofing in Google Chrome for Android (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker misrepresent the browser UI through the Picture-in-Picture code path, so that a crafted HTML page can make the displayed address bar show a false origin. Exploitation requires the victim to navigate to the attacker's page and be deceived by the spoofed UI (UI:R); the flaw yields UI deception only and cannot execute code, read data, or persist. No public exploit identified at time of analysis and no CISA KEV listing; a vendor patch (155.0.8059.39) was available at release, making this a low-priority issue despite the moderate 5.4 CVSS published by NVD, which our assessment narrows to integrity impact alone.
Local information disclosure in Google Chrome on Android versions prior to 155.0.8059.39 allows a co-installed malicious app to access sensitive information without user interaction or authentication, though exploitation requires high attack complexity and the pre-existence of an attacker-controlled app on the same device. This moderate-severity issue (CVSS 5.1) has no public exploit identified at time of analysis, and vendor patch 155.0.8059.39 is available.
UI spoofing in Google Chrome on Android (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker misrepresent browser UI elements by luring a victim to a crafted HTML page, which can be used to make spoofed origins or prompts look trustworthy. Exploitation requires the user to actively navigate to the attacker-controlled page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), and the resulting harm is limited to user deception rather than code execution or direct data theft. There is no public exploit identified at time of analysis, and CISA's SSVC decision framework rates exploitation as 'none' with low automability, consistent with the low-to-moderate EPSS-style risk profile of a Medium-severity Chromium UI bug.
Out-of-sandbox memory disclosure affects Google Chrome on Android builds prior to 155.0.8059.39, where an uninitialized resource in Dawn, Chrome's WebGPU implementation, can be triggered by a crafted HTML page to leak memory contents. Exploitation is constrained: it requires the victim to open attacker-influenced content that exercises WebGPU (user interaction is mandatory, UI:R) and yields only a LOW-confidentiality read with no integrity or availability impact, giving a CVSS 3.1 base score of 4.7 and EPSS of just 0.19% (8th percentile). No public exploit code has been identified at time of analysis, this CVE is not on CISA KEV, and a vendor patch is available in Chrome 155.0.8059.39.
UI spoofing in Google Chrome on Android (versions prior to 155.0.8059.39) stems from incorrect authorization handling in the WebShare feature and allows a remote attacker who has already compromised the renderer process to spoof UI elements via a crafted HTML page that the victim must interact with. The assessed impact is limited to integrity spoofing (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N), with no confidentiality or availability impact, and no public exploit identified at time of analysis. Exploitation is gated by the non-default prerequisite of a compromised renderer plus required user interaction, making this a low-priority issue despite the medium Chromium severity label.
Incorrect reference resolution in the Offline component of Google Chrome on Android before 155.0.8059.39 allows an attacker to obtain sensitive information from beyond the renderer's own data. Exploitation is not autonomous: it requires that the attacker has already compromised the Chrome renderer process on the Android device and that the victim loads a crafted HTML page, which is why the assessed vector carries high attack complexity (AC:H) and a user-interaction requirement (UI:R) despite network reachability. Impact is limited to confidentiality with no integrity or availability effect, no public exploit code has been identified at time of analysis, and CISA's SSVC decision framework rates exploitation as "none" and the issue as not automatable, making this a defense-in-depth fix rather than a frontline emergency. A vendor patch is available and the issue is tracked as EUVD-2026-93741 and in the Chromium issue tracker.
UI spoofing in Google Chrome on Android before 155.0.8059.39 allows a remote, unauthenticated attacker to render deceptive Messages interface elements from a crafted HTML page, tricking a victim who has been socially engineered into interacting with the spoofed content. Successful exploitation requires the victim to actively open the attacker's page and then engage with the fake UI (UI:R), and the resulting impact is limited to Low confidentiality - there is no code execution, memory corruption, or data exfiltration path described. There is no public exploit identified at time of analysis and no CISA KEV listing; Chromium rates the issue Medium, and the affected scope appears confined to the Android build of Chrome, with desktop and other platforms not indicated.
Incorrect authorization in Google Chrome's built-in PDF handling on Android (versions prior to 155.0.8059.39) allows a malicious application already co-installed on the same device to obtain sensitive information after the victim is socially engineered into interacting with a crafted PDF. The issue is unauthenticated from a credentials standpoint (CVSS PR:N) but is effectively local in nature: it cannot be triggered purely remotely, it depends on the attacker first getting a separate app onto the device, it requires victim interaction, and its impact is confined to confidentiality with no integrity or availability effect. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation=none and Automatable=no, and Chromium rates the issue Medium severity; the signals point to a genuine but low-urgency issue rather than a top priority, though a vendor patch is available and should be applied through normal update cycles.
Cross-site request forgery in the ReadingList feature of Google Chrome for Android (versions prior to 155.0.8059.39) allows a remote attacker to bypass web origin policy by social-engineering a victim into loading a crafted HTML page. Exploitation requires user interaction (UI:R) and is limited to the Android platform; no public exploit code has been identified and the EPSS score is low at 0.18% (7th percentile). Google has released a patched version (155.0.8059.39), and the issue is rated medium severity by Chromium.
Web origin policy bypass in Google Chrome for Android (versions prior to 155.0.8059.39) lets a local attacker using a co-installed app escape the browser's same-origin restrictions by winning a race condition in the Custom Tabs component. Exploitation is not remote: per the assessed vector (AV:L/AC:H/PR:L/UI:R) the attacker must already have a malicious app installed on the same device (low privileges, PR:L) and must rely on victim user interaction, typically opening a link that launches a Custom Tab. There is no CISA KEV entry and no public exploit identified at time of analysis, and EPSS is negligible at 0.09% (percentile 0%), so this is a moderate-priority hardening issue rather than an urgent one.
Authentication and access-control bypass in Google Chrome on Android before version 155.0.8059.39 lets a malicious app already installed on the same device act as a confused deputy, driving Chrome's UI into a privileged page and circumventing system access restrictions. The flaw is local-only (AV:L) and requires the attacker to first get their app onto the victim's device via sideloading or a trojanized application, after which no further interaction with Chrome is needed (UI:N); impact is limited to partial confidentiality and integrity loss with no availability impact (CVSS 4.4). There is confirmed vendor patching but no public exploit identified at time of analysis and no CISA KEV listing, and EPSS is negligible (0.11%, 1st percentile), ranking this as a low-to-moderate, local-only issue rather than an urgent priority.
Information disclosure in Google Chrome on Android before 155.0.8059.39 allows a remote attacker who has already compromised the renderer process to read memory outside the GPU sandbox by serving a crafted HTML page. The flaw (CWE-908, use of an uninitialized resource in the GPU path) is a chain-dependent bug rather than a standalone entry point: it requires a separate renderer compromise plus victim interaction to load malicious content, and the impact stops at memory disclosure with no code execution, integrity, or availability loss. No public exploit has been identified at time of analysis, EPSS is low at 0.24 percent (13th percentile), and Google has released a fix in Chrome 155.0.8059.39 at Chromium severity Medium.