Android
Monthly
An information disclosure flaw in the Omnibox component of Google Chrome for Android lets a remote attacker leak sensitive data through crafted network traffic, provided the victim first performs an attacker-influenced interaction (a social-engineering lure). Only Chrome on Android builds earlier than 155.0.8059.39 are affected; desktop and iOS Chrome are out of scope per the vendor advisory, and the impact is limited to confidentiality with no integrity or availability effect. Google rates the Chromium severity as Medium, EPSS is low at 0.20 percent (9th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, though a vendor fix is available and should be applied through normal update channels.
Memory disclosure in Google Chrome on Android before 155.0.8059.39 lets a remote attacker who persuades a victim to open a crafted HTML page read uninitialized GPU memory that lies outside the browser sandbox, exposing data the page should never be able to observe. The bug is rated CVSS 3.1 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) - unauthenticated remote triggering is possible but requires the victim to actively load the malicious page, only confidentiality is partially affected, and there is no integrity or availability impact, so this is an information-leak primitive rather than a code-execution path. Risk is currently low: EPSS is 0.24% (13th percentile), no public exploit code has been identified at time of analysis, and CISA KEV does not list it, but the disclosure crosses the sandbox boundary, which is why Google assigned Medium severity and the vector shows a scope change.
Incorrect authorization in Google Chrome for Android prior to 155.0.8059.39 allows a locally co-installed malicious application to obtain sensitive information from the browser through a social-engineering precondition. Exploitation is confined to the same Android device: a local attacker (the assessed vector requires no privileges, PR:N) must persuade the victim to install or run a hostile app alongside Chrome, and the high attack complexity (AC:H) reflects that non-trivial co-installation and user-interaction dependency; impact is limited to confidentiality, with no integrity or availability loss. There is no public exploit code and no confirmed active exploitation at time of analysis - CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial - and Google has released a vendor patch, so this is a low-to-moderate priority defect rather than an urgent one.
Incorrect authorization in the WebAppInstalls component of Google Chrome for Android before 155.0.8059.39 lets a remote, unauthenticated attacker bypass Android system access restrictions when a victim loads a crafted HTML page. Rated CVSS v3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and Chromium security severity Medium, the issue is a genuine but moderate-priority logic flaw rather than an emergency: EPSS is only 0.19% (8th percentile), no public exploit identified at time of analysis, and it is not in CISA KEV, with the Android-specific WebAppInstalls code path and mandatory user interaction being the main factors limiting real-world exploitation. Vendor-released patch: Chrome 155.0.8059.39.
Improper input validation in the Omnibox of Google Chrome for Android prior to 155.0.8059.39 lets a remote attacker bypass web origin policy using a crafted HTML page, a weakness rated High by Chromium's security team but only Moderate (CVSS 5.4) under the generalized rubric. The attack is unauthenticated (PR:N) but requires the victim to be socially engineered into opening the malicious page (UI:R), and the resulting impact is bounded to partial confidentiality and integrity exposure with no availability loss. No public exploit code has been identified at time of analysis, EPSS is low at roughly 0.18% (7th percentile), and there is no CISA KEV listing; exploitation is limited to Android builds below 155.0.8059.39 and a vendor patch is available.
Web origin policy bypass in Google Chrome on Android lets unauthenticated remote attackers cross same-origin boundaries by inducing a victim to open a crafted HTML page that is rendered through the CustomTabs feature, in releases prior to 155.0.8059.39. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) and yields only partial confidentiality and integrity impact with no availability effect and no scope change, so this is a moderate, not top-tier, priority. No public exploit code has been identified at time of analysis and EPSS is low at 0.20% (9th percentile), though the vendor has shipped a fixed Chrome release and Chromium rates the issue High severity on its internal scale.
Local privilege escalation in Google Android's platform message handler lets an actor who already holds System-level execution privileges bypass a missing permission check in platform_msg_handler_init (default_msg_handlers.c) and obtain high-impact control over confidentiality, integrity, and availability on the device. Rated CVSS 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the issue requires local access and a pre-existing high privilege level, making it an authorization-boundary bypass for an already-privileged local actor rather than a path to initial device compromise. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, while a vendor fix is published in the October 2026 Android Security Bulletin.
An out-of-bounds write in the Android kernel's Wacom HID driver (wacom_hid_set_device_mode in wacom_sys.c) lets an attacker who can physically attach or emulate a malicious Wacom HID peripheral corrupt kernel memory and escalate privileges on the affected device. No authentication or user interaction is required once the peripheral is connected, because the crafted report reaches the driver's missing bounds check directly; the CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms a physical-access-only attack path with high confidentiality, integrity, and availability impact. Only Pixel/Android kernel builds that include and exercise the Wacom HID driver are affected, and there is no public exploit identified at time of analysis; CISA SSVC rates exploitation as none and automatable as no, so the practical risk is bounded by the strict physical-access requirement and the inability to exploit this remotely or at scale.
A logic error in the Android kernel hardware-crypto driver routine kdn_set_sysregs_prot (hwcrypto-kdn.c) causes an information disclosure, but only for an attacker who already executes code with System-level privileges directly on the affected Pixel/Tensor device. The CVSS base score is 4.4 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, reflecting a local-only, high-privilege, confidentiality-only impact with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV (SSVC: Exploitation none). In practice this is a genuine-but-low-priority weakness that hardens an already-compromised or highly privileged execution context rather than a remotely reachable or pre-auth escalation path.
A missing permission check in the is_pd_allowed function of Android's gem_msg.c kernel source (CWE-862, Missing Authorization) allows an attacker who already holds System execution privileges to bypass an authorization decision and read otherwise-protected information. Impact is limited to local information disclosure - confidentiality-only (C:H) with no integrity or availability effect - and exploitation requires a local foothold running as System (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.4); no user interaction is needed. There is no public exploit identified at time of analysis, exploitation is assessed as non-automatable (SSVC Exploitation: none), and this is a low-priority, post-compromise authorization gap behind an already-high trust boundary rather than an initial-access bug. Google Devices reported the flaw and a fix is referenced through the Android/Pixel October 2026 security bulletin.
Out-of-bounds write in the Qualcomm Snapdragon Android Camera driver allows a locally privileged process to corrupt memory by submitting command buffer requests carrying invalid length parameters, potentially achieving code execution or memory corruption within the driver's execution context on affected devices. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires local access and an already-privileged process capable of reaching the camera driver interface, making this realistically a post-compromise privilege-escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis. The CPE entry (cpe:2.3:a:qualcomm,_inc.:snapdragon:*) carries no version constraint, so the exact affected chipset and firmware coverage must be resolved from Qualcomm's October 2026 security bulletin.
An out-of-bounds read in Android's camera3 stream splitter (DeprecatedCamera3StreamSplitter.cpp, returnOutputBufferLocked) lets a locally installed, low-privileged application read a small amount of adjacent process memory while camera output buffers are being returned, potentially disclosing limited information on Android 14, 15, 16, 16-qpr2, and 17. The flaw is a missing bounds check reachable only from local code already running on the device (CVSS 3.1 base 3.3, AV:L/PR:L/UI:N, C:L/I:N/A:N), and no public exploit identified at time of analysis, with SSVC assessing exploitation as 'none' and not automatable. The issue is fixed in the October 2026 Android Security Bulletin (2026-10-01) patch level, and this is a genuinely low-severity, low-priority issue despite being in the ubiquitous Android platform.
Persistent local denial of service in Android's DevicePolicyManagerService (Android 14, 15, 16, 16-QPR2 and 17) allows an on-device caller holding device-owner or profile-owner rights to feed malformed input into the setPermissionGrantState path and corrupt persisted permission/policy state. Because the resulting denial of service is persistent rather than transient, recovery typically requires administrative cleanup (clearing policy state, removing the managed profile/account, or in the worst case a factory reset) rather than a simple reboot. Scoring is AV:L/PR:L/UI:N with availability-only impact (CVSS 5.5), there is no remote vector, and no public exploit has been identified at time of analysis; CISA SSVC records Exploitation: none and Automatable: no, so this is a moderate local availability issue rather than an urgent, remotely exploitable flaw.
Out-of-bounds read in Google Android's MMS PDU parsing code (PduParser.java) allows a remote attacker who can deliver a crafted or malformed Protocol Data Unit to the device to trigger a denial of service against the affected messaging/telephony component, with no user interaction required. Affected platforms are Android 14, 15, 16, 16-qpr2 and 17, per the EUVD version list and the wildcard CPE cpe:2.3:a:google:android:*; the vulnerability is rated CVSS 6.5 (MEDIUM), though independent review downgrades the availability impact to Low and confirms confidentiality and integrity are unaffected, with no code execution possible. No public exploit code has been identified and SSVC rates the issue as non-automatable with exploitation status 'none', so this is assessed as a moderate, low-priority denial-of-service hardening issue rather than an urgent threat.
An out-of-bounds read in Android's NFC Type 5 Tag reader/writer implementation (rw_t5t.cc) lets a local, low-privileged context read memory that should be out of reach, resulting in information disclosure with no user interaction required. The flaw carries a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and per that vector the attacker must already hold a low-privileged foothold on the device, such as an installed application capable of exercising the NFC read path; there is no write or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and remediated builds are addressed through the Android Security Bulletin dated 2026-10-01.
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level privileges to escalate to kernel-level code execution via a type confusion that leads to an out-of-bounds write. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and no public exploit has been identified at the time of analysis. This is a post-compromise escalation step, not a remote or initial-access vector.
A missing permission check in the MediaTek AIDL (Android Interface Definition Language) component allows an attacker who already holds the Android System privilege to escalate to higher privileges locally, with no user interaction required. The expected impact is high across confidentiality, integrity, and availability (CVSS 3.1 base 6.7, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but the local-only vector and the PR:H precondition mean an ordinary unprivileged app cannot trigger it directly - it is only useful as a second-stage step in an existing exploit chain or for already-privileged malware. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); this is a moderate, defense-in-depth issue rather than a top-tier emergency.
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-level privilege to gain elevated code execution through an integer overflow (CWE-190), with no user interaction required. The flaw affects a broad set of MediaTek chipsets (including MT6893, MT6895, MT6983, MT6991, and MT8188) running unpatched firmware and is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, but MediaTek has published patch ID ALPS11296678 in its October 2026 security bulletin.
Local privilege escalation in the MediaTek display component lets a process that already holds System privilege trigger an out-of-bounds write in a display-path buffer, corrupting memory and potentially escalating to higher-level code execution with high impact to confidentiality, integrity, and availability. The defect is a missing bounds check (CWE-787) reachable without user interaction and with low attack complexity, but only from an existing System-privileged, on-device context (CVSS 3.1 6.7 Medium, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it functions as a second-stage escalation primitive rather than an initial-access or remote vector. Affected hardware spans a broad set of MediaTek chipsets including MT6991, MT6993, MT2718, MT8168-class MT8668/MT8678, MT8171, MT8188, MT8189, MT8196, MT8793, and MT8126; MediaTek has issued Patch ID ALPS11292777 (issue MSV-9195) and no public exploit code has been identified at time of analysis.
Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT6768, MT6853, MT6893, MT6991, MT8186, MT8188 and MT8196) allows an attacker who already holds System privilege to trigger an out-of-bounds write through a missing bounds check, yielding high impact to confidentiality, integrity and availability. No user interaction is required once System access is held, and the flaw is reachable in default configurations of the listed chipsets, making it a post-compromise escalation rather than an initial foothold; the CVSS 6.7 score is dominated by the PR:H prerequisite. A vendor patch is available under MediaTek's October 2026 Product Security Bulletin (patch ID ALPS11276677, issue MSV-9217), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper access control in Samsung's ManagedProvisioning system component allows a locally present application to install arbitrary packages on affected Galaxy devices running firmware older than the September 2026 Security Maintenance Release (SMR Sep-2026 Release 1). Exploitation requires an attacker-controlled app already executing on the device (AV:L) but demands no additional privileges (PR:N) and no user interaction (UI:N), so a malicious or sideloaded app can drive a privileged provisioning path to install software the user never authorized. No confirmed actively exploited (CISA KEV) status and no publicly available exploit code identified at time of analysis, and the independent reassessment (CVSS 3.1 6.9, C:N/I:H/A:N) frames this as a moderate, locally scoped integrity risk rather than an urgent, remotely reachable one.
Revoking runtime permissions from other apps is possible on Motorola devices running Motorola Setup App versions before the 2026-01-01 fixed release, because an exported Setup App component lacks a guarding permission (CWE-862). A local, low-privilege malicious app already installed on the same device can trigger this without user interaction (CVSS 4.8, PR:L/UI:N); remote exploitation is not possible, and there is no data disclosure. No public exploit code identified at time of analysis, and the vendor has made a patch available.
Cleartext transmission of application traffic in the Joyland AI Android app exposes data to on-path attackers positioned on the same LAN or Wi-Fi segment, because the app explicitly opts into cleartext HTTP on Android 9+ where the platform default blocks it. Only data the app actually sends over plain HTTP is exposed, and the exposure is passive disclosure - no code execution, account takeover, or data modification results - with authentication not required (CVSS vector PR:N) and confidentiality impact scored low. No public exploit code has been identified at time of analysis (no public exploit identified at time of analysis), and no CISA KEV listing or EPSS signal was provided; the practical attack prerequisite is an adjacent-network or on-path foothold, which excludes remote internet-only attackers.
Information disclosure in Google Chrome on Android before version 154.0.8037.92 allows an attacker who has already compromised the renderer process to read memory outside the browser sandbox by getting the victim to load a crafted HTML page. The flaw is an uninitialized-resource bug (CWE-908) in the GPU component, so it leaks memory rather than executing code or modifying state, and the practical exploitability is sharply limited by the precondition that the attacker must first hold a compromised renderer - a requirement the scored vector does not capture despite PR:N. Scored CVSS is only 3.4 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N), no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) is associated with this CVE; a vendor-released fix exists in Chrome 154.0.8037.92, making this a low-priority patch-and-move-on item despite Chromium's 'High' security severity label.
Information disclosure in Google Chrome on Android prior to 154.0.8037.92 lets a remote attacker read cross-origin data by delivering a crafted HTML page that drives GPU rendering and reads back uninitialized GPU memory. The flaw is unauthenticated (CVSS PR:N) but gated by required user interaction (UI:R) - the victim must open the malicious page - and its impact is confined to low confidentiality loss (C:L), with no code execution, data modification, or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment rates the bug non-automatable with only partial technical impact, so real-world risk remains low despite Chromium's 'High' severity label.
Uninitialized-resource handling in Dawn, Chromium's WebGPU implementation, exposes Chrome for Android builds prior to 154.0.8037.92 to out-of-bounds memory reads triggered by a crafted HTML page (CWE-908). A remote attacker who convinces a victim to load the malicious content can leak limited graphics-process memory that may fall outside the browser sandbox boundary, although the CVSS 3.1 score of 4.7 with C:L/I:N/A:N indicates the payoff is a low-confidence information disclosure rather than code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fixed build.
Address-bar spoofing in Google Chrome for Android versions prior to 154.0.8037.92 lets a remote attacker misrepresent the Omnibox (URL bar) to a victim who opens a crafted HTML page, according to Google's own Chromium severity rating of High. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3) confirms this is an unauthenticated, network-reachable attack that hinges entirely on user interaction, with only a low-integrity impact on the browser UI and no confidentiality or availability loss, and the CISA SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) places it at low real-world priority. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limitation is that the attacker must first lure the target to a malicious page, and only the Android build is affected - desktop and iOS Chrome users are out of scope.
Firefox for Android before 157 can be tricked by a malicious web page into misrepresenting download information in its Downloads component, a spoofing flaw rated CVSS 5.4 (Medium, AV:N/AC:L/PR:N/UI:R). Only the Android builds are affected - desktop Firefox is not implicated - and Mozilla shipped the fix in Firefox 157. Exploitation requires the victim to visit an attacker-controlled page and interact with a download prompt, no public exploit code has been identified at time of analysis, and CISA SSVC records exploitation as 'none', so this is a low-to-moderate priority fix rather than an urgent one.
The Wikipedia Android App's cookie manager could release Wikimedia CentralAuth session cookies to an attacker-controlled domain, exposing logged-in users' session tokens to interception and reuse. The flaw sits in the app's SharedPreferenceCookieManager, which matched cookie domains with a loose suffix check (`domain.endsWith(domainSpec)`) and did not require both the request domain and the cookie's stored domain to be genuine Wikimedia authorities, so a lookalike host such as a domain ending in wikipedia.org could match an approved suffix. Exploitation is not zero-click: it requires the target to be authenticated (holding CentralAuth cookies) and to be induced into making the app request the attacker's domain, which is why the vendor scores it 5.3 (medium) and our independent assessment lands at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the underlying logic is fixed by upstream pull request 6768.
Stored cross-site scripting in Readwise Reader for Android (versions 8.7.2 through 8.10.1) lets an attacker who controls a document's metadata - notably the author meta tag - inject script that runs inside the app's WebView when the victim opens the imported document on a synced device. The root problem is a missing HTML sanitization step: attacker-controlled metadata arrives at the WebView through innerHTML without escaping. Exploitation is unauthenticated (CVSS PR:N) but requires the victim to open specifically crafted content (UI:R), and the resulting impact is partial confidentiality and integrity within the WebView context (CVSS 6.1); no public exploit identified at time of analysis, and the CISA SSVC assessment records exploitation as none with the flaw not automatable at scale, making this a low real-world priority rather than an urgent threat.
Client-side cross-site scripting in Readwise Reader for Android versions 8.7.2 up to but not including 8.10.1 lets an attacker craft a document containing malicious SVG markup whose event-handler attributes (such as 'onload' or 'onerror') survive the app's sanitize-html pass and execute inside the Reader WebView when the victim opens it. Exploitation requires user interaction - the victim must add and render the attacker-supplied document - and the impact is scoped to the WebView rather than the underlying device; the attacker needs no credentials to author the content, but delivery depends on getting it in front of the victim. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with partial technical impact, and the assessment places real-world risk at a moderate level consistent with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Stored cross-site scripting in Readwise Reader for Android versions 8.7.2 through 8.10.1 allows an attacker who can place a crafted document into a victim's library to execute injected script when that document synchronizes to the device and is opened in the app's WebView. The flaw is unauthenticated from the attacker's perspective (CVSS vector PR:N) but requires victim interaction (UI:R): the document must be synced and rendered before the malicious metadata is interpolated into a URL and written into the DOM via innerHTML. Impact is scoped to the WebView context (S:C with C:L/I:L/A:N), yielding a 6.1 base score; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), with CISA SSVC rating exploitation as none, automatable as no, and technical impact as partial.
Hard-coded cryptographic key material embedded in the Tohoku Electric Power 'Yorisou e Net' Android and iOS apps can be recovered by inspecting or reverse-engineering the installed application package, potentially exposing whatever data or service that key protects. Both mobile builds are affected (per the vendor CPE entries), and the CVSS vector indicates physical access to the device (AV:P) with no authentication (PR:N) and no user interaction (UI:N) required, so the practical gate is simply obtaining and analyzing the app rather than any remote precondition. Impact is confined to a low-confidence confidentiality loss (C:L, no integrity or availability effect) and the advisory does not specify what the recovered key protects downstream; all signals point to a low-priority issue, with no public exploit code identified at time of analysis and no EPSS or KEV data provided. The JVN advisory JVN93985674 is the primary coordinated-disclosure reference.
Secure Folder 1.2, an Android vault app distributed as com.securefolder.securevault on Google Play, stores files selected for its password-protected vault as unencrypted files inside the Android shared-storage tree, so any co-resident application or file manager holding read access to that path can enumerate, copy, and open the vaulted files without authenticating to Secure Folder. The exposure is strictly local: the CVSS 4.0 vector requires local access with low privileges (AV:L, PR:L) and no user interaction, and impact is confidentiality-only, matching our independent CVSS 3.1 assessment (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), which characterizes real-world risk as low-to-moderate despite the 6.8 base score. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a design-level information disclosure rather than an actively attacked flaw. Any deployment of version 1.2 with files added to the vault is affected by default, since the plaintext storage behavior is not the result of an optional setting.
Non-privileged applications running on a ZTE nubia Z80 Ultra (NX741J) smartphone can retrieve the device's Wi-Fi MAC address by querying the read-only factory_mac_address field exposed through the Android Settings.Secure content database, defeating the platform's normal restriction on hardware MAC address access. The issue is purely local (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N, base score 3.3, C:L/I:N/A:N), requires an attacker-supplied app to already be installed and executing on the handset, and leaks only a single low-sensitivity hardware identifier whose main value is device tracking rather than data compromise. According to available intelligence, no public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; deployment is limited to a single consumer handset model, which keeps overall risk low.
Local file disclosure in Calculator Lock for Android allows a local actor with shared external storage access, such as an authorized non-root ADB shell or a co-resident file-reading app, to copy the vault's SQLite database and media files without entering the calculator passcode. The published CVSS is 6.8, and the independent assessment (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability impact; the passcode still gates the in-app UI. The independent assessment classifies this as a genuine but low-urgency local issue, and no public exploit identified at time of analysis.
Path traversal in Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 allows a co-resident malicious application on the same device to write attacker-controlled bytes outside the app's intended staging directory by passing a crafted _display_name containing traversal sequences through the exported OneTouchUploadActivity and PrintShopCloudActivity components. Because the write lands in the authenticated user's Cloud staging/upload path, injected content can be pushed into that user's Verizon Cloud account without any interaction from the victim. The issue is local-only (a malicious app must already be installed and running on the device), is assessed as a moderate-severity integrity-only flaw with no confidentiality or availability impact, and no public exploit code was identified at time of analysis; the vendor has released a fix in version 26.7.10.
Local attackers with authenticated access can retrieve cleartext-stored credentials from the Fermax DuoxMe Android app versions prior to 4.3.4 and impersonate the user account. This CWE-312 vulnerability requires local access to the device, and on non-rooted devices the app sandbox normally protects the data, so root or device-level access is the practical prerequisite. No public exploit code has been identified at time of analysis, and the risk is assessed as a modest-severity local issue.
Uninitialized memory use in multiple locations of the Android kernel allows a locally-positioned attacker who already holds System-level execution privileges to read stale kernel memory contents, resulting in information disclosure. The flaw is rated CVSS 4.4 (AV:L/PR:H) and affects Android builds covered by the September 2026 Pixel/Android Security Bulletin; user interaction is not required. No public exploit code and no CISA KEV listing were identified at time of analysis, and the exploitation prerequisite of pre-existing System privileges keeps the practical risk confined to post-compromise or privileged-local scenarios.
A time-of-check to time-of-use (TOCTOU) race condition in multiple locations of the Android kernel allows an attacker who already holds System-level execution privileges on a device to win a timing window and escalate to higher (kernel/root) privileges, with no user interaction required. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is fixed through the September 2026 Android Security Bulletin for Pixel devices. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied, so the practical risk is concentrated in post-compromise privilege escalation rather than remote mass exploitation.
Local privilege escalation in Google Android/Pixel arises from a permission bypass in the DreamPickerReceiver.kt component (the Daydream/screensaver picker), where a confused-deputy flaw lets a locally installed application reach privileged operations that execute with System privileges. Affected are Android/Pixel builds at security patch levels prior to the 2026-09-01 bulletin; exploitation requires the attacker to already have local code execution via a malicious or compromised app, and no user interaction is needed once that app is present. The issue is fully local (AV:L) with no remote or network reach, no public exploit code has been identified at time of analysis, and devices carrying the 2026-09-01 patch level are not exposed.
A logic error in the Android kernel's ACFW FF-A (Firmware Framework for Arm A-profile) driver, implemented in acfw_ffa.c, allows a caller already holding System-level execution privileges to read memory that should remain secret, resulting in local information disclosure. Exploitation requires local access and high privileges, needs no user interaction, and affects Android devices carrying the affected kernel build per Google's Pixel security bulletin for September 2026. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 base score of 4.4 reflects limited confidentiality impact confined to already-privileged local actors.
Permission bypass logic errors in Google Android allow a local actor who already holds System-level execution privileges to gain further privileges on affected devices, including Pixel handsets addressed by the September 2026 Android Security Bulletin. The flaw stems from a protection-mechanism failure in which permission checks in unspecified locations are skipped, requiring only local access and no user interaction; an attacker cannot use it for initial compromise or to escalate from an ordinary unprivileged app, since System privileges are a hard prerequisite. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment that this is a genuine but low-priority issue.
Local privilege escalation in the Android kernel affects Google Pixel devices and is addressed by the September 2026 Pixel security bulletin; an attacker who already holds System-level execution privileges on the device can exploit a logic error in the code to gain further elevated access. The flaw is a logic error rather than a memory-safety bug, requires no user interaction, and is not remotely reachable - the CVSS vector (AV:L/PR:H/UI:N) confirms it is only usable as a secondary escalation step after an initial high-privilege local compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and the EPSS score of roughly 0.12% (2nd percentile) reflects the low likelihood of exploitation, making this a low real-world priority despite the 6.7 'Medium' base score.
Memory corruption in the Android Trusted Execution Environment (TEE) allows a local attacker who already holds System execution privileges to escalate privileges within the secure world by supplying improperly validated input to an affected secure-world interface. The flaw is local-only (AV:L), requires high pre-existing privileges (PR:H), and needs no user interaction (UI:N), yielding high confidentiality, integrity, and availability impact if the corrupted trusted application is reached; Google rates it 6.7 (Medium). Risk is tempered by the significant foothold required, the local-only attack surface, and the low EPSS score (0.11%, 2nd percentile); no public exploit code has been identified and the flaw is not listed in CISA KEV, with fixes delivered in the Pixel security bulletin dated 2026-09-01.
Local privilege escalation in Google Android's Video Processing Unit (VPU) component lets an attacker who already holds System-level execution privileges supply improperly validated input that overwrites shared memory, yielding high confidentiality, integrity, and availability impact with no user interaction required. The flaw (CWE-20) affects Android/Pixel builds that predate the 2026-09-01 security patch level and is only reachable locally, not over a network. Exploitation is constrained by the PR:H prerequisite - an ordinary unprivileged app cannot reach the vulnerable path - and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is correspondingly low at 0.11% (2nd percentile).
An out-of-bounds read in ReadDataElement (common.c) within the Android platform allows a locally installed application to disclose sensitive memory contents without any additional execution privileges or user interaction. The flaw is a missing/incorrect bounds check on an attacker-influenced length or index value, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N), so the practical impact is confidentiality loss rather than code execution. Affected builds are Android platform components referenced by the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is absent from the supplied data.
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
Local privilege escalation in the Android kernel's address remapping code (addr_remap_address_map in remap.c) allows an attacker who already holds System-level execution privileges to further elevate their access on the device. The flaw is a logic error in mapping validation that constitutes a protection-mechanism failure (CWE-693); successful exploitation requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N), with no user interaction, and yields high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS is negligible at 0.12% (2nd percentile), and fixes are bundled into Google's 2026-09-01 Android/Pixel security bulletin, making this a genuine but bounded issue rather than a top-tier emergency.
Local privilege escalation in the Android kernel lets an attacker who already holds System-level execution privileges bypass a permission check and extend that access further on affected Pixel devices covered by the September 2026 Android Security Bulletin. The flaw is a logic error in permission handling (CWE-693) that requires no user interaction but is gated behind the high precondition of pre-existing System execution context (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7), making it a privilege-boundary bypass chained after an initial compromise rather than a standalone entry point. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment of a genuinely low-priority, locally-scoped issue.
A logic error in the Android kernel's VPU (Video Processing Unit) driver can disclose kernel memory contents to code that is already running with System-level privileges. The flaw is local-only: CVSS gives AV:L with PR:H, so an attacker must first obtain elevated (System) execution on the device before triggering the information leak, and no user interaction is required once that precondition is met. There is no public exploit code and no CISA KEV listing at time of analysis, and the associated EPSS data was not supplied, so this should be treated as a post-compromise information-disclosure primitive rather than a remotely exploitable issue.
Local privilege escalation in the Android bootloader lets a caller that already holds System execution privileges bypass a missing permission check and reach higher-privileged bootloader operations on affected Android devices. The CVSS vector (AV:L/PR:H/UI:N) makes clear this is a second-stage escalation that requires both local access and an existing high-privileged foothold, not a remote or unprivileged-app vector, and it needs no user interaction. Google resolves it through the September 2026 Android/Pixel security bulletin; EPSS is very low (0.11%, 2nd percentile) and no public exploit has been identified at time of analysis.
Local privilege escalation in Google Android's image authentication service (image-auth-srv.c) allows a component that already holds System execution privileges to abuse a logic error in the gsa_sw_pk_hash_compare public-key hash-comparison routine, achieving escalation into a more trusted execution context. The flaw is reachable only locally (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), so it is not an initial-access or remote vector. Exploitability signals are weak: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the practical risk is a defense-in-depth weakness affecting Pixel/Android builds that ship the affected image authentication service.
Local privilege escalation in the Android kernel's ac_init_one_sswrp() initialization routine (init.c) allows an attacker who already holds System execution privileges on an affected Android/Pixel device to escalate further by abusing a logic error in the code, with no user interaction required. Because the assessed vector is AV:L/PR:H, this is a post-compromise escalation primitive rather than a remote or unauthenticated entry point - the pre-existing System-level foothold is the primary limiting factor, which sharply narrows realistic exploitation to attackers who have already breached a highly privileged process. No public exploit code or CISA KEV listing was identified at time of analysis, EPSS is very low (0.12%, roughly the 2nd percentile), and Google has shipped a fix in the September 2026 Pixel bulletin (2026-09-01) - consistent with a genuine but low-priority issue.
Local privilege escalation in the Android Bootloader lets an attacker who already holds System-level execution privileges (PR:H) bypass a missing permission check on an exposed bootloader interface and escalate to higher integrity, confidentiality, and availability impact on the device. Exploitation is local only (AV:L), requires no user interaction (UI:N), and is confined to post-compromise escalation of a privilege boundary on affected Pixel/Android firmware, which is why the assessed severity is moderate (CVSS 6.7) despite high C/I/A ratings. EPSS is very low at 0.12% (2nd percentile), no public exploit code exists, and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; Google's September 2026 Pixel security bulletin covers the fix.
An out-of-bounds read in the AES-GCM-256 crypto implementation of the Android kernel (function do_sss_aes_gcm_256_op in crypto-aes.c) allows disclosure of memory contents to code that is already running at System privilege on an affected device. The flaw is a missing bounds check on an input length or index (CWE-120 class buffer handling error), rated 4.4 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation is local and requires the attacker to already hold System (PR:H) execution privileges; no user interaction is needed once that position is held. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the entry point sits behind a high privilege boundary the practical risk is a post-compromise or chained privilege-escalation information leak rather than an independent remote threat.
Stored Cross-Site Scripting in the web backend of Repetico 1.9.7.31 for Android allows an authenticated remote user to inject and execute arbitrary JavaScript in other users' app contexts by embedding a malicious payload in a multiple-choice question text field. The CVSS Scope:Changed metric confirms the injected script can affect victim users beyond the attacker's own session, enabling session hijacking, credential theft, or unauthorized in-app actions. A researcher-published PoC writeup on GitHub confirms the attack path. No vendor patch or advisory has been identified at this time.
Double-free in the Samsung Exynos Display Processing Unit (DPU) kernel driver allows a local low-privileged attacker to corrupt kernel heap memory and trigger a use-after-free condition across nine Exynos chip families spanning mid-range to flagship Samsung devices. Exploitation requires meeting a high-complexity timing condition during DMA buffer reallocation in the DPU driver, limiting practical attack surface despite the kernel-level impact. No public exploit code exists and this CVE has not been added to the CISA KEV catalog at the time of analysis.
Heap overflow via TOCTOU race in the Exynos DRM HDR Driver affects Samsung Mobile Processors across nine Exynos SoC generations (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600), enabling a local low-privileged attacker to crash the kernel. The race condition occurs in the Display Processing Unit's HDR handling path, where a check-then-use window can be exploited to corrupt kernel heap memory, resulting in a denial-of-service condition. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Sensitive credential information leak in the Passwords component of Google Chrome on Android (prior to 153.0.8010.36) enables a remote unauthenticated attacker to extract password data by luring a victim to a crafted HTML page. Despite Chromium classifying the severity as 'Low', the NVD CVSS vector assigns C:H reflecting that full credential disclosure is possible. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.21% (11th percentile) signals low automated exploitation pressure at time of analysis.
Missing authorization (CWE-862) in Chrome's WebView component on Android prior to 153.0.8010.36 allows remote attackers to bypass Android system access restrictions through crafted network traffic. Exploitation is gated behind social engineering - the attacker must trick a user into interacting with malicious content, yielding a high integrity impact but no confidentiality or availability consequence. Chromium's own team rated this 'Low' severity, a notable divergence from the NVD CVSS 6.5, and no public exploit or active exploitation has been identified.
Improper input validation in the Safebrowsing component of Google Chrome on Android prior to 153.0.8010.36 enables a remote attacker to bypass system access restrictions through a crafted HTML page. Exploitation requires social engineering to direct an Android Chrome user to the malicious page (UI:R), limiting opportunistic attack surface. No public exploit code has been identified and EPSS is very low (0.22%, 13th percentile), though the integrity-only CVSS 6.5 accurately reflects a meaningful access restriction bypass on a ubiquitously deployed browser. Vendor-released patch is available in Chrome 153.0.8010.36.
Google Chrome's Downloads subsystem on Android prior to 153.0.8010.36 improperly enforces its behavioral workflow (CWE-841), allowing a remote attacker to bypass Android system access restrictions via a crafted HTML page combined with social engineering. The attacker achieves high integrity impact - likely the ability to write files or trigger downloads that circumvent Android's permission and access control model - without any confidentiality or availability exposure. No public exploit exists and EPSS sits at 0.22% (13th percentile), placing real-world exploitation risk low despite the network-accessible attack vector.
Out-of-bounds read in Android's 802.11be (WiFi 7 / EHT) parsing code exposes kernel or userspace memory to adjacent attackers across all currently supported Android releases (14, 15, 16, 16-QPR2, and 17). The flaw resides in get_eht_operation_channel_width() within ieee802_11_common.c, where an incorrect bounds check allows a crafted EHT Operation element - delivered via a rogue access point - to read past the end of a buffer, leaking memory contents to the attacker. With EPSS at 0.12% and no KEV listing, real-world exploitation is not currently observed, but the adjacency-only prerequisite makes this relevant to targeted or physical-proximity attacks.
Local information disclosure in Android's AppFuseBridge framework component allows any installed app to read files or data it lacks permission to access. The vulnerability exists in the openFile() method of AppFuseBridge.java, where a missing permission check (CWE-693) permits a low-privileged local process to bypass access controls without user interaction. Affected versions span Android 14 through 17, including the QPR2 interim release, giving this issue a broad footprint across current Android deployments. No public exploit or active exploitation has been identified; EPSS is 0.12% (2nd percentile), consistent with the local-only, low-impact nature of the flaw.
Local information disclosure in Android 15 through 17 exploits a confused deputy flaw in `screenArgsForPermissionCheckIfAny`, allowing a low-privileged local app to bypass permission validation and access data it should not be authorized to read. The flaw stems from a privileged component incorrectly acting on behalf of a less-privileged caller without adequate permission verification, resulting in unauthorized local data exposure. No public exploit has been identified at time of analysis, and with an EPSS of 0.12% this is assessed as low-priority despite Android's broad deployment footprint.
Missing permission check in multiple functions of RangingServiceImpl.java on Android enables a man-in-the-middle attacker to intercept ranging service communications and disclose sensitive information without requiring additional execution privileges. Affected versions span Android 16, Android 16-QPR2, and Android 17, covering current and near-future Android releases. No public exploit has been identified at time of analysis, and EPSS is very low at 0.14%, but the network-reachable attack surface and absence of user interaction required warrant attention in environments handling proximity or location-sensitive data.
Local information disclosure in Android 14 through 17 stems from a logic error across multiple functions in XmpDataParser.java that causes improper sanitization of XMP metadata during media file parsing. A local attacker with standard user-level privileges can trigger the flaw without any user interaction, leaking restricted information from the parsing context. No public exploit code or active exploitation has been identified, and the September 2026 Android Security Bulletin provides the authoritative patch.
Persistent local denial of service in Android's VoiceInteractionManagerService affects versions 14 through 17 via resource exhaustion in the initForUserNoTracing method. A low-privilege local attacker - such as a malicious installed app - can exhaust system resources without any user interaction, rendering the device persistently unavailable. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with limited real-world exploitation interest.
Tapjacking via malicious UI overlay in Android 17's ContactsPickerActivity allows a locally installed application to present misleading UI over the contacts picker, resulting in local information disclosure of contact data. The attack requires only low-privilege access (a sideloaded or installed app) and no user interaction once the overlay is active. No public exploit code is identified, and EPSS at the 2nd percentile reflects negligible opportunistic exploitation probability.
Bluetooth encryption downgrade in Android's `btm_sec_encrypt_change` function (btm_sec.cc) exposes information on Android 17 and Android 16-QPR2 devices by allowing a logic error in encryption change handling to be exploited without user interaction. A Bluetooth-adjacent attacker with a low-privilege connection can trigger the downgrade, reducing encryption strength and enabling passive interception of Bluetooth traffic. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.16%, indicating very low observed exploitation probability.
Local information disclosure in Android 16 and 17 exposes the device Bluetooth MAC address through a missing permission check in the writeToParcel method of BleRssiRangingCapabilities.java. Any low-privileged local application can invoke this code path without holding the required Bluetooth permission, silently retrieving a hardware identifier that can be used to track a device across networks. No public exploit has been identified at time of analysis, and CISA SSVC assessment places exploitation at none.
Location metadata disclosure in Android 17's MediaProvider component allows a low-privileged local app to bypass permission enforcement in getQueryBuilderInternal of MediaProvider.java and retrieve GPS coordinates embedded as EXIF metadata in media files without holding the ACCESS_MEDIA_LOCATION permission. The root cause is CWE-862 (Missing Authorization) in the query builder logic - the authorization gate that should block location-tagged media queries from unpermissioned callers is absent or incorrectly applied. No public exploit has been identified, and the CVSS 3.3 score reflects both the constrained local attack surface and the limited disclosure scope.
Persistent denial-of-service in Android's WifiNetworkSuggestionsManager affects versions 15 through 17, including 16-QPR2. The `add` method in WifiNetworkSuggestionsManager.java fails to enforce resource consumption limits (CWE-400), allowing a low-privileged local application to exhaust system resources and render the device unresponsive or degraded without any user interaction. No confidentiality or integrity impact exists; the risk is purely availability-based, but the 'persistent' characterization implies the DoS survives reboots or normal recovery paths.
Permanent local denial of service in Android's GameManagerService affects devices running Android 14 through 16-qpr2, exploitable by any low-privilege application without user interaction. The vulnerable code path - `parseInterventionFromXml` in `GameManagerService.java` - fails to bound resource consumption during XML parsing of game mode intervention data, allowing a locally installed app to exhaust system resources and render the service permanently unavailable until device reboot. No public exploit has been identified; the September 2026 Android Security Bulletin addresses this vulnerability.
Permanent local denial-of-service in Android's PackageInstallerService allows a low-privilege local attacker to irreversibly disable an affected device through a logic error in the createSessionInternal session-creation path. Affected releases are Android 16-qpr2 and Android 17, as confirmed by Google's September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the monthly Android security update.
Unauthorized access to and modification of device credentials is possible in Android 14 through 17 due to a missing permission check in the `onCreate` method of `ConfirmDeviceCredentialActivity.java`. Any locally installed application running with standard user-level privileges can trigger this flaw without requiring user interaction, gaining read access to - and potentially altering - stored device credential state. No public exploit code exists and EPSS sits at 0.11% (2nd percentile), placing current real-world exploitation risk very low despite the breadth of affected Android versions.
Local information disclosure in Android 14-16 allows any installed app with basic privileges to read wallet contextual location data by calling WalletContextualLocationsService without a working authorization gate. The root cause is a missing permission check in the isCallerAllowed method of WalletContextualLocationsService.kt (CWE-862): the service fails to verify that the caller holds the required wallet-access permission before returning location context. Impact is limited to confidentiality of wallet location data; no code execution, integrity modification, or privilege escalation is possible. No public exploit code has been identified and EPSS is 0.11% (2nd percentile), reflecting negligible current exploitation interest.
Path traversal in Adobe Photoshop Mobile for Android (≤1.6.0.2294 and ≤1.6.0.2299) enables a low-privileged attacker to cause a security feature bypass, reading unauthorized files or directories outside the app's intended sandbox and producing high availability impact when a victim opens a maliciously crafted Photoshop document. The CVSS 3.1 score of 5.0 captures the meaningful constraints: local attack vector, high complexity, required user interaction, and the fact that exploitation depends on conditions beyond the attacker's control. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Origin validation error (CWE-346) in Microsoft Teams for Android enables an authenticated network attacker with user interaction to disclose sensitive cross-origin information. Affecting all versions prior to 1416/1.0.0.2026142702, the flaw allows a malicious origin to extract data that the Teams application fails to properly restrict, resulting in a scope-changed confidentiality breach rated C:H by Microsoft. No public exploit has been identified at time of analysis, and a vendor patch is available.
Microsoft Teams for Android before build 1416/1.0.0.2026133602 inserts sensitive information into outbound network transmissions (CWE-201), enabling a low-privileged authenticated attacker to intercept and read confidential data over the network when a victim user performs an in-app action. The CVSS scope change (S:C) with high confidentiality impact (C:H) signals that the leaked data can cross trust boundaries beyond the attacker's own session, potentially exposing other users' or sessions' sensitive material. No public exploit identified at time of analysis; Microsoft has released a patch via the MSRC advisory.
Local privilege escalation in MediaTek's Audio Hardware Abstraction Layer (HAL) on Android devices allows an attacker who already holds System-level privilege to further escalate access through improper input validation, achieving full confidentiality, integrity, and availability compromise of the affected device. The vulnerability spans 57 distinct MediaTek chipsets across the MT6xxx and MT8xxx families and is addressed in MediaTek's September 2026 security bulletin under Patch ID ALPS11087540 (Issue ID: MSV-8246). No public exploit code or active exploitation has been identified at time of analysis, and EPSS places exploitation probability at 0.13%.
Memory corruption via use-after-free in the Android SurfaceFlinger graphics compositor, present on specific MediaTek chipsets (MT6881, MT6993, MT6858, MT8668), enables a local attacker who has already obtained System-level privilege to escalate to higher privileges - potentially root or kernel - without any user interaction. Reported by MediaTek in the September 2026 Security Bulletin under Patch ID ALPS11123860 and Issue ID MSV-8890. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none and automatable as no, consistent with the high-privilege prerequisite.
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants, allowing an attacker who has already gained System-level privilege to escalate further to higher privilege tiers without any user interaction. The flaw is confirmed by MediaTek in their September 2026 Product Security Bulletin under Patch ID ALPS11134622 and Issue ID MSV-8894. No public exploit code or active exploitation is confirmed; SSVC designates this as non-automatable with no current exploitation activity.
MiracastService on MediaTek Smart TV and DTV chipsets exposes a confused deputy condition (CWE-926) that allows a local app running with user-level privileges to trigger a denial-of-service against the Wi-Fi Display subsystem. The flaw stems from an improperly exported Android application component that lets an unprivileged caller invoke MiracastService capabilities without holding the necessary permissions, crashing or disabling the service. No public exploit code exists and SSVC rates exploitation as none, placing this firmly in the routine patch tier with a vendor-confirmed CVSS 5.5.
Web origin policy bypass in Google Chrome for Android (prior to 152.0.7977.82) exploits a use-of-released-resource flaw (CWE-672) in the browser's mobile implementation, allowing cross-origin content manipulation via a crafted HTML page. An attacker must socially engineer a victim into visiting the malicious page, after which Chrome's Same-Origin Policy enforcement can be circumvented, resulting in high integrity impact against targeted origins. No public exploit code or CISA KEV listing exists at time of analysis; Google issued a fix in stable channel release 152.0.7977.82.
Local information disclosure in Android Verified Boot (AVB) allows an attacker with local access to read a small amount of out-of-bounds memory by supplying malformed RSA key data to the iavb_parse_key_data function in avb_rsa.c. The vulnerability affects Google Android devices (CPE: cpe:2.3:a:google:android) and requires local access, no additional execution privileges (PR:N), and no user interaction (UI:N) per the CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.09%, 1st percentile; CISA SSVC exploitation: none), and the impact is limited to confidentiality (C:L) with no integrity or availability effect.
An out-of-bounds read in Android's RTCP APP packet decoder (decodeAppPacket in RtcpAppPacket.cpp) allows a remote party to a media session to read a limited amount of adjacent memory and disclose that information, with no code execution, integrity, or availability impact. Affected are Android/Pixel builds prior to the 2026-06-01 security patch level; the flaw is remotely reachable without authentication and without user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, confidentiality impact Low only), though the practical precondition is that the attacker be a participant in, or able to inject packets into, an active RTP/RTCP media session handled by the vulnerable parser. There is no CISA KEV entry, no publicly available exploit code identified at time of analysis, and EPSS is only 0.20% (9th percentile), so exploitation likelihood is very low despite the network attack vector.
An out-of-bounds read in Android's RTP media stack, specifically in RtpPacket::decodePacket, can leak a small amount of adjacent memory to a remote party that delivers a crafted RTP packet while the device is participating in a media or VoIP session. Exploitation requires no privileges (CVSS PR:N) but does require the victim to engage in the RTP session (UI:R), and the resulting impact is limited to partial confidentiality loss (C:L) with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is low at 0.18% (8th percentile); CISA SSVC rates exploitation as none and the issue as not automatable.
An information disclosure flaw in the Omnibox component of Google Chrome for Android lets a remote attacker leak sensitive data through crafted network traffic, provided the victim first performs an attacker-influenced interaction (a social-engineering lure). Only Chrome on Android builds earlier than 155.0.8059.39 are affected; desktop and iOS Chrome are out of scope per the vendor advisory, and the impact is limited to confidentiality with no integrity or availability effect. Google rates the Chromium severity as Medium, EPSS is low at 0.20 percent (9th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, though a vendor fix is available and should be applied through normal update channels.
Memory disclosure in Google Chrome on Android before 155.0.8059.39 lets a remote attacker who persuades a victim to open a crafted HTML page read uninitialized GPU memory that lies outside the browser sandbox, exposing data the page should never be able to observe. The bug is rated CVSS 3.1 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) - unauthenticated remote triggering is possible but requires the victim to actively load the malicious page, only confidentiality is partially affected, and there is no integrity or availability impact, so this is an information-leak primitive rather than a code-execution path. Risk is currently low: EPSS is 0.24% (13th percentile), no public exploit code has been identified at time of analysis, and CISA KEV does not list it, but the disclosure crosses the sandbox boundary, which is why Google assigned Medium severity and the vector shows a scope change.
Incorrect authorization in Google Chrome for Android prior to 155.0.8059.39 allows a locally co-installed malicious application to obtain sensitive information from the browser through a social-engineering precondition. Exploitation is confined to the same Android device: a local attacker (the assessed vector requires no privileges, PR:N) must persuade the victim to install or run a hostile app alongside Chrome, and the high attack complexity (AC:H) reflects that non-trivial co-installation and user-interaction dependency; impact is limited to confidentiality, with no integrity or availability loss. There is no public exploit code and no confirmed active exploitation at time of analysis - CISA's SSVC decision framework rates exploitation as none, automatable as no, and technical impact as partial - and Google has released a vendor patch, so this is a low-to-moderate priority defect rather than an urgent one.
Incorrect authorization in the WebAppInstalls component of Google Chrome for Android before 155.0.8059.39 lets a remote, unauthenticated attacker bypass Android system access restrictions when a victim loads a crafted HTML page. Rated CVSS v3.1 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) and Chromium security severity Medium, the issue is a genuine but moderate-priority logic flaw rather than an emergency: EPSS is only 0.19% (8th percentile), no public exploit identified at time of analysis, and it is not in CISA KEV, with the Android-specific WebAppInstalls code path and mandatory user interaction being the main factors limiting real-world exploitation. Vendor-released patch: Chrome 155.0.8059.39.
Improper input validation in the Omnibox of Google Chrome for Android prior to 155.0.8059.39 lets a remote attacker bypass web origin policy using a crafted HTML page, a weakness rated High by Chromium's security team but only Moderate (CVSS 5.4) under the generalized rubric. The attack is unauthenticated (PR:N) but requires the victim to be socially engineered into opening the malicious page (UI:R), and the resulting impact is bounded to partial confidentiality and integrity exposure with no availability loss. No public exploit code has been identified at time of analysis, EPSS is low at roughly 0.18% (7th percentile), and there is no CISA KEV listing; exploitation is limited to Android builds below 155.0.8059.39 and a vendor patch is available.
Web origin policy bypass in Google Chrome on Android lets unauthenticated remote attackers cross same-origin boundaries by inducing a victim to open a crafted HTML page that is rendered through the CustomTabs feature, in releases prior to 155.0.8059.39. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) and yields only partial confidentiality and integrity impact with no availability effect and no scope change, so this is a moderate, not top-tier, priority. No public exploit code has been identified at time of analysis and EPSS is low at 0.20% (9th percentile), though the vendor has shipped a fixed Chrome release and Chromium rates the issue High severity on its internal scale.
Local privilege escalation in Google Android's platform message handler lets an actor who already holds System-level execution privileges bypass a missing permission check in platform_msg_handler_init (default_msg_handlers.c) and obtain high-impact control over confidentiality, integrity, and availability on the device. Rated CVSS 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), the issue requires local access and a pre-existing high privilege level, making it an authorization-boundary bypass for an already-privileged local actor rather than a path to initial device compromise. There is no public exploit identified at time of analysis and CISA's SSVC assessment records Exploitation: none and Automatable: no, while a vendor fix is published in the October 2026 Android Security Bulletin.
An out-of-bounds write in the Android kernel's Wacom HID driver (wacom_hid_set_device_mode in wacom_sys.c) lets an attacker who can physically attach or emulate a malicious Wacom HID peripheral corrupt kernel memory and escalate privileges on the affected device. No authentication or user interaction is required once the peripheral is connected, because the crafted report reaches the driver's missing bounds check directly; the CVSS 3.1 vector (AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) confirms a physical-access-only attack path with high confidentiality, integrity, and availability impact. Only Pixel/Android kernel builds that include and exercise the Wacom HID driver are affected, and there is no public exploit identified at time of analysis; CISA SSVC rates exploitation as none and automatable as no, so the practical risk is bounded by the strict physical-access requirement and the inability to exploit this remotely or at scale.
A logic error in the Android kernel hardware-crypto driver routine kdn_set_sysregs_prot (hwcrypto-kdn.c) causes an information disclosure, but only for an attacker who already executes code with System-level privileges directly on the affected Pixel/Tensor device. The CVSS base score is 4.4 (Medium) with vector AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, reflecting a local-only, high-privilege, confidentiality-only impact with no integrity or availability effect; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV (SSVC: Exploitation none). In practice this is a genuine-but-low-priority weakness that hardens an already-compromised or highly privileged execution context rather than a remotely reachable or pre-auth escalation path.
A missing permission check in the is_pd_allowed function of Android's gem_msg.c kernel source (CWE-862, Missing Authorization) allows an attacker who already holds System execution privileges to bypass an authorization decision and read otherwise-protected information. Impact is limited to local information disclosure - confidentiality-only (C:H) with no integrity or availability effect - and exploitation requires a local foothold running as System (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, score 4.4); no user interaction is needed. There is no public exploit identified at time of analysis, exploitation is assessed as non-automatable (SSVC Exploitation: none), and this is a low-priority, post-compromise authorization gap behind an already-high trust boundary rather than an initial-access bug. Google Devices reported the flaw and a fix is referenced through the Android/Pixel October 2026 security bulletin.
Out-of-bounds write in the Qualcomm Snapdragon Android Camera driver allows a locally privileged process to corrupt memory by submitting command buffer requests carrying invalid length parameters, potentially achieving code execution or memory corruption within the driver's execution context on affected devices. Because the CVSS vector is AV:L/PR:H/UI:N, exploitation requires local access and an already-privileged process capable of reaching the camera driver interface, making this realistically a post-compromise privilege-escalation primitive rather than an initial-access vector; no public exploit identified at time of analysis. The CPE entry (cpe:2.3:a:qualcomm,_inc.:snapdragon:*) carries no version constraint, so the exact affected chipset and firmware coverage must be resolved from Qualcomm's October 2026 security bulletin.
An out-of-bounds read in Android's camera3 stream splitter (DeprecatedCamera3StreamSplitter.cpp, returnOutputBufferLocked) lets a locally installed, low-privileged application read a small amount of adjacent process memory while camera output buffers are being returned, potentially disclosing limited information on Android 14, 15, 16, 16-qpr2, and 17. The flaw is a missing bounds check reachable only from local code already running on the device (CVSS 3.1 base 3.3, AV:L/PR:L/UI:N, C:L/I:N/A:N), and no public exploit identified at time of analysis, with SSVC assessing exploitation as 'none' and not automatable. The issue is fixed in the October 2026 Android Security Bulletin (2026-10-01) patch level, and this is a genuinely low-severity, low-priority issue despite being in the ubiquitous Android platform.
Persistent local denial of service in Android's DevicePolicyManagerService (Android 14, 15, 16, 16-QPR2 and 17) allows an on-device caller holding device-owner or profile-owner rights to feed malformed input into the setPermissionGrantState path and corrupt persisted permission/policy state. Because the resulting denial of service is persistent rather than transient, recovery typically requires administrative cleanup (clearing policy state, removing the managed profile/account, or in the worst case a factory reset) rather than a simple reboot. Scoring is AV:L/PR:L/UI:N with availability-only impact (CVSS 5.5), there is no remote vector, and no public exploit has been identified at time of analysis; CISA SSVC records Exploitation: none and Automatable: no, so this is a moderate local availability issue rather than an urgent, remotely exploitable flaw.
Out-of-bounds read in Google Android's MMS PDU parsing code (PduParser.java) allows a remote attacker who can deliver a crafted or malformed Protocol Data Unit to the device to trigger a denial of service against the affected messaging/telephony component, with no user interaction required. Affected platforms are Android 14, 15, 16, 16-qpr2 and 17, per the EUVD version list and the wildcard CPE cpe:2.3:a:google:android:*; the vulnerability is rated CVSS 6.5 (MEDIUM), though independent review downgrades the availability impact to Low and confirms confidentiality and integrity are unaffected, with no code execution possible. No public exploit code has been identified and SSVC rates the issue as non-automatable with exploitation status 'none', so this is assessed as a moderate, low-priority denial-of-service hardening issue rather than an urgent threat.
An out-of-bounds read in Android's NFC Type 5 Tag reader/writer implementation (rw_t5t.cc) lets a local, low-privileged context read memory that should be out of reach, resulting in information disclosure with no user interaction required. The flaw carries a CVSS 3.1 base score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), and per that vector the attacker must already hold a low-privileged foothold on the device, such as an installed application capable of exercising the NFC read path; there is no write or code-execution impact. No public exploit code or confirmed active exploitation was identified at time of analysis, and remediated builds are addressed through the Android Security Bulletin dated 2026-10-01.
Local privilege escalation in MediaTek venc on multiple chipsets allows an attacker who already possesses System-level privileges to escalate to kernel-level code execution via a type confusion that leads to an out-of-bounds write. The vulnerability requires local access and high privileges (PR:H) with no user interaction, and no public exploit has been identified at the time of analysis. This is a post-compromise escalation step, not a remote or initial-access vector.
A missing permission check in the MediaTek AIDL (Android Interface Definition Language) component allows an attacker who already holds the Android System privilege to escalate to higher privileges locally, with no user interaction required. The expected impact is high across confidentiality, integrity, and availability (CVSS 3.1 base 6.7, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), but the local-only vector and the PR:H precondition mean an ordinary unprivileged app cannot trigger it directly - it is only useful as a second-stage step in an existing exploit chain or for already-privileged malware. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); this is a moderate, defense-in-depth issue rather than a top-tier emergency.
Local privilege escalation in the MediaTek display component could allow an attacker who already holds Android System-level privilege to gain elevated code execution through an integer overflow (CWE-190), with no user interaction required. The flaw affects a broad set of MediaTek chipsets (including MT6893, MT6895, MT6983, MT6991, and MT8188) running unpatched firmware and is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis, but MediaTek has published patch ID ALPS11296678 in its October 2026 security bulletin.
Local privilege escalation in the MediaTek display component lets a process that already holds System privilege trigger an out-of-bounds write in a display-path buffer, corrupting memory and potentially escalating to higher-level code execution with high impact to confidentiality, integrity, and availability. The defect is a missing bounds check (CWE-787) reachable without user interaction and with low attack complexity, but only from an existing System-privileged, on-device context (CVSS 3.1 6.7 Medium, AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), so it functions as a second-stage escalation primitive rather than an initial-access or remote vector. Affected hardware spans a broad set of MediaTek chipsets including MT6991, MT6993, MT2718, MT8168-class MT8668/MT8678, MT8171, MT8188, MT8189, MT8196, MT8793, and MT8126; MediaTek has issued Patch ID ALPS11292777 (issue MSV-9195) and no public exploit code has been identified at time of analysis.
Local privilege escalation in the battery component shipped with a wide range of MediaTek chipsets (including MT6765, MT6768, MT6853, MT6893, MT6991, MT8186, MT8188 and MT8196) allows an attacker who already holds System privilege to trigger an out-of-bounds write through a missing bounds check, yielding high impact to confidentiality, integrity and availability. No user interaction is required once System access is held, and the flaw is reachable in default configurations of the listed chipsets, making it a post-compromise escalation rather than an initial foothold; the CVSS 6.7 score is dominated by the PR:H prerequisite. A vendor patch is available under MediaTek's October 2026 Product Security Bulletin (patch ID ALPS11276677, issue MSV-9217), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Improper access control in Samsung's ManagedProvisioning system component allows a locally present application to install arbitrary packages on affected Galaxy devices running firmware older than the September 2026 Security Maintenance Release (SMR Sep-2026 Release 1). Exploitation requires an attacker-controlled app already executing on the device (AV:L) but demands no additional privileges (PR:N) and no user interaction (UI:N), so a malicious or sideloaded app can drive a privileged provisioning path to install software the user never authorized. No confirmed actively exploited (CISA KEV) status and no publicly available exploit code identified at time of analysis, and the independent reassessment (CVSS 3.1 6.9, C:N/I:H/A:N) frames this as a moderate, locally scoped integrity risk rather than an urgent, remotely reachable one.
Revoking runtime permissions from other apps is possible on Motorola devices running Motorola Setup App versions before the 2026-01-01 fixed release, because an exported Setup App component lacks a guarding permission (CWE-862). A local, low-privilege malicious app already installed on the same device can trigger this without user interaction (CVSS 4.8, PR:L/UI:N); remote exploitation is not possible, and there is no data disclosure. No public exploit code identified at time of analysis, and the vendor has made a patch available.
Cleartext transmission of application traffic in the Joyland AI Android app exposes data to on-path attackers positioned on the same LAN or Wi-Fi segment, because the app explicitly opts into cleartext HTTP on Android 9+ where the platform default blocks it. Only data the app actually sends over plain HTTP is exposed, and the exposure is passive disclosure - no code execution, account takeover, or data modification results - with authentication not required (CVSS vector PR:N) and confidentiality impact scored low. No public exploit code has been identified at time of analysis (no public exploit identified at time of analysis), and no CISA KEV listing or EPSS signal was provided; the practical attack prerequisite is an adjacent-network or on-path foothold, which excludes remote internet-only attackers.
Information disclosure in Google Chrome on Android before version 154.0.8037.92 allows an attacker who has already compromised the renderer process to read memory outside the browser sandbox by getting the victim to load a crafted HTML page. The flaw is an uninitialized-resource bug (CWE-908) in the GPU component, so it leaks memory rather than executing code or modifying state, and the practical exploitability is sharply limited by the precondition that the attacker must first hold a compromised renderer - a requirement the scored vector does not capture despite PR:N. Scored CVSS is only 3.4 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N), no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) is associated with this CVE; a vendor-released fix exists in Chrome 154.0.8037.92, making this a low-priority patch-and-move-on item despite Chromium's 'High' security severity label.
Information disclosure in Google Chrome on Android prior to 154.0.8037.92 lets a remote attacker read cross-origin data by delivering a crafted HTML page that drives GPU rendering and reads back uninitialized GPU memory. The flaw is unauthenticated (CVSS PR:N) but gated by required user interaction (UI:R) - the victim must open the malicious page - and its impact is confined to low confidentiality loss (C:L), with no code execution, data modification, or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment rates the bug non-automatable with only partial technical impact, so real-world risk remains low despite Chromium's 'High' severity label.
Uninitialized-resource handling in Dawn, Chromium's WebGPU implementation, exposes Chrome for Android builds prior to 154.0.8037.92 to out-of-bounds memory reads triggered by a crafted HTML page (CWE-908). A remote attacker who convinces a victim to load the malicious content can leak limited graphics-process memory that may fall outside the browser sandbox boundary, although the CVSS 3.1 score of 4.7 with C:L/I:N/A:N indicates the payoff is a low-confidence information disclosure rather than code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fixed build.
Address-bar spoofing in Google Chrome for Android versions prior to 154.0.8037.92 lets a remote attacker misrepresent the Omnibox (URL bar) to a victim who opens a crafted HTML page, according to Google's own Chromium severity rating of High. The assessed CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N, 4.3) confirms this is an unauthenticated, network-reachable attack that hinges entirely on user interaction, with only a low-integrity impact on the browser UI and no confidentiality or availability loss, and the CISA SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial) places it at low real-world priority. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV; the practical limitation is that the attacker must first lure the target to a malicious page, and only the Android build is affected - desktop and iOS Chrome users are out of scope.
Firefox for Android before 157 can be tricked by a malicious web page into misrepresenting download information in its Downloads component, a spoofing flaw rated CVSS 5.4 (Medium, AV:N/AC:L/PR:N/UI:R). Only the Android builds are affected - desktop Firefox is not implicated - and Mozilla shipped the fix in Firefox 157. Exploitation requires the victim to visit an attacker-controlled page and interact with a download prompt, no public exploit code has been identified at time of analysis, and CISA SSVC records exploitation as 'none', so this is a low-to-moderate priority fix rather than an urgent one.
The Wikipedia Android App's cookie manager could release Wikimedia CentralAuth session cookies to an attacker-controlled domain, exposing logged-in users' session tokens to interception and reuse. The flaw sits in the app's SharedPreferenceCookieManager, which matched cookie domains with a loose suffix check (`domain.endsWith(domainSpec)`) and did not require both the request domain and the cookie's stored domain to be genuine Wikimedia authorities, so a lookalike host such as a domain ending in wikipedia.org could match an approved suffix. Exploitation is not zero-click: it requires the target to be authenticated (holding CentralAuth cookies) and to be induced into making the app request the attacker's domain, which is why the vendor scores it 5.3 (medium) and our independent assessment lands at CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N; no public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the underlying logic is fixed by upstream pull request 6768.
Stored cross-site scripting in Readwise Reader for Android (versions 8.7.2 through 8.10.1) lets an attacker who controls a document's metadata - notably the author meta tag - inject script that runs inside the app's WebView when the victim opens the imported document on a synced device. The root problem is a missing HTML sanitization step: attacker-controlled metadata arrives at the WebView through innerHTML without escaping. Exploitation is unauthenticated (CVSS PR:N) but requires the victim to open specifically crafted content (UI:R), and the resulting impact is partial confidentiality and integrity within the WebView context (CVSS 6.1); no public exploit identified at time of analysis, and the CISA SSVC assessment records exploitation as none with the flaw not automatable at scale, making this a low real-world priority rather than an urgent threat.
Client-side cross-site scripting in Readwise Reader for Android versions 8.7.2 up to but not including 8.10.1 lets an attacker craft a document containing malicious SVG markup whose event-handler attributes (such as 'onload' or 'onerror') survive the app's sanitize-html pass and execute inside the Reader WebView when the victim opens it. Exploitation requires user interaction - the victim must add and render the attacker-supplied document - and the impact is scoped to the WebView rather than the underlying device; the attacker needs no credentials to author the content, but delivery depends on getting it in front of the victim. There is no public exploit identified at time of analysis, CISA SSVC records exploitation as 'none' with partial technical impact, and the assessment places real-world risk at a moderate level consistent with a CVSS 3.1 score of 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N).
Stored cross-site scripting in Readwise Reader for Android versions 8.7.2 through 8.10.1 allows an attacker who can place a crafted document into a victim's library to execute injected script when that document synchronizes to the device and is opened in the app's WebView. The flaw is unauthenticated from the attacker's perspective (CVSS vector PR:N) but requires victim interaction (UI:R): the document must be synced and rendered before the malicious metadata is interpolated into a URL and written into the DOM via innerHTML. Impact is scoped to the WebView context (S:C with C:L/I:L/A:N), yielding a 6.1 base score; no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), with CISA SSVC rating exploitation as none, automatable as no, and technical impact as partial.
Hard-coded cryptographic key material embedded in the Tohoku Electric Power 'Yorisou e Net' Android and iOS apps can be recovered by inspecting or reverse-engineering the installed application package, potentially exposing whatever data or service that key protects. Both mobile builds are affected (per the vendor CPE entries), and the CVSS vector indicates physical access to the device (AV:P) with no authentication (PR:N) and no user interaction (UI:N) required, so the practical gate is simply obtaining and analyzing the app rather than any remote precondition. Impact is confined to a low-confidence confidentiality loss (C:L, no integrity or availability effect) and the advisory does not specify what the recovered key protects downstream; all signals point to a low-priority issue, with no public exploit code identified at time of analysis and no EPSS or KEV data provided. The JVN advisory JVN93985674 is the primary coordinated-disclosure reference.
Secure Folder 1.2, an Android vault app distributed as com.securefolder.securevault on Google Play, stores files selected for its password-protected vault as unencrypted files inside the Android shared-storage tree, so any co-resident application or file manager holding read access to that path can enumerate, copy, and open the vaulted files without authenticating to Secure Folder. The exposure is strictly local: the CVSS 4.0 vector requires local access with low privileges (AV:L, PR:L) and no user interaction, and impact is confidentiality-only, matching our independent CVSS 3.1 assessment (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), which characterizes real-world risk as low-to-moderate despite the 6.8 base score. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a design-level information disclosure rather than an actively attacked flaw. Any deployment of version 1.2 with files added to the vault is affected by default, since the plaintext storage behavior is not the result of an optional setting.
Non-privileged applications running on a ZTE nubia Z80 Ultra (NX741J) smartphone can retrieve the device's Wi-Fi MAC address by querying the read-only factory_mac_address field exposed through the Android Settings.Secure content database, defeating the platform's normal restriction on hardware MAC address access. The issue is purely local (assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N, base score 3.3, C:L/I:N/A:N), requires an attacker-supplied app to already be installed and executing on the handset, and leaks only a single low-sensitivity hardware identifier whose main value is device tracking rather than data compromise. According to available intelligence, no public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV; deployment is limited to a single consumer handset model, which keeps overall risk low.
Local file disclosure in Calculator Lock for Android allows a local actor with shared external storage access, such as an authorized non-root ADB shell or a co-resident file-reading app, to copy the vault's SQLite database and media files without entering the calculator passcode. The published CVSS is 6.8, and the independent assessment (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability impact; the passcode still gates the in-app UI. The independent assessment classifies this as a genuine but low-urgency local issue, and no public exploit identified at time of analysis.
Path traversal in Verizon Cloud for Android (com.vcast.mediamanager) before 26.7.10 allows a co-resident malicious application on the same device to write attacker-controlled bytes outside the app's intended staging directory by passing a crafted _display_name containing traversal sequences through the exported OneTouchUploadActivity and PrintShopCloudActivity components. Because the write lands in the authenticated user's Cloud staging/upload path, injected content can be pushed into that user's Verizon Cloud account without any interaction from the victim. The issue is local-only (a malicious app must already be installed and running on the device), is assessed as a moderate-severity integrity-only flaw with no confidentiality or availability impact, and no public exploit code was identified at time of analysis; the vendor has released a fix in version 26.7.10.
Local attackers with authenticated access can retrieve cleartext-stored credentials from the Fermax DuoxMe Android app versions prior to 4.3.4 and impersonate the user account. This CWE-312 vulnerability requires local access to the device, and on non-rooted devices the app sandbox normally protects the data, so root or device-level access is the practical prerequisite. No public exploit code has been identified at time of analysis, and the risk is assessed as a modest-severity local issue.
Uninitialized memory use in multiple locations of the Android kernel allows a locally-positioned attacker who already holds System-level execution privileges to read stale kernel memory contents, resulting in information disclosure. The flaw is rated CVSS 4.4 (AV:L/PR:H) and affects Android builds covered by the September 2026 Pixel/Android Security Bulletin; user interaction is not required. No public exploit code and no CISA KEV listing were identified at time of analysis, and the exploitation prerequisite of pre-existing System privileges keeps the practical risk confined to post-compromise or privileged-local scenarios.
A time-of-check to time-of-use (TOCTOU) race condition in multiple locations of the Android kernel allows an attacker who already holds System-level execution privileges on a device to win a timing window and escalate to higher (kernel/root) privileges, with no user interaction required. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is fixed through the September 2026 Android Security Bulletin for Pixel devices. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied, so the practical risk is concentrated in post-compromise privilege escalation rather than remote mass exploitation.
Local privilege escalation in Google Android/Pixel arises from a permission bypass in the DreamPickerReceiver.kt component (the Daydream/screensaver picker), where a confused-deputy flaw lets a locally installed application reach privileged operations that execute with System privileges. Affected are Android/Pixel builds at security patch levels prior to the 2026-09-01 bulletin; exploitation requires the attacker to already have local code execution via a malicious or compromised app, and no user interaction is needed once that app is present. The issue is fully local (AV:L) with no remote or network reach, no public exploit code has been identified at time of analysis, and devices carrying the 2026-09-01 patch level are not exposed.
A logic error in the Android kernel's ACFW FF-A (Firmware Framework for Arm A-profile) driver, implemented in acfw_ffa.c, allows a caller already holding System-level execution privileges to read memory that should remain secret, resulting in local information disclosure. Exploitation requires local access and high privileges, needs no user interaction, and affects Android devices carrying the affected kernel build per Google's Pixel security bulletin for September 2026. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 base score of 4.4 reflects limited confidentiality impact confined to already-privileged local actors.
Permission bypass logic errors in Google Android allow a local actor who already holds System-level execution privileges to gain further privileges on affected devices, including Pixel handsets addressed by the September 2026 Android Security Bulletin. The flaw stems from a protection-mechanism failure in which permission checks in unspecified locations are skipped, requiring only local access and no user interaction; an attacker cannot use it for initial compromise or to escalate from an ordinary unprivileged app, since System privileges are a hard prerequisite. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment that this is a genuine but low-priority issue.
Local privilege escalation in the Android kernel affects Google Pixel devices and is addressed by the September 2026 Pixel security bulletin; an attacker who already holds System-level execution privileges on the device can exploit a logic error in the code to gain further elevated access. The flaw is a logic error rather than a memory-safety bug, requires no user interaction, and is not remotely reachable - the CVSS vector (AV:L/PR:H/UI:N) confirms it is only usable as a secondary escalation step after an initial high-privilege local compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and the EPSS score of roughly 0.12% (2nd percentile) reflects the low likelihood of exploitation, making this a low real-world priority despite the 6.7 'Medium' base score.
Memory corruption in the Android Trusted Execution Environment (TEE) allows a local attacker who already holds System execution privileges to escalate privileges within the secure world by supplying improperly validated input to an affected secure-world interface. The flaw is local-only (AV:L), requires high pre-existing privileges (PR:H), and needs no user interaction (UI:N), yielding high confidentiality, integrity, and availability impact if the corrupted trusted application is reached; Google rates it 6.7 (Medium). Risk is tempered by the significant foothold required, the local-only attack surface, and the low EPSS score (0.11%, 2nd percentile); no public exploit code has been identified and the flaw is not listed in CISA KEV, with fixes delivered in the Pixel security bulletin dated 2026-09-01.
Local privilege escalation in Google Android's Video Processing Unit (VPU) component lets an attacker who already holds System-level execution privileges supply improperly validated input that overwrites shared memory, yielding high confidentiality, integrity, and availability impact with no user interaction required. The flaw (CWE-20) affects Android/Pixel builds that predate the 2026-09-01 security patch level and is only reachable locally, not over a network. Exploitation is constrained by the PR:H prerequisite - an ordinary unprivileged app cannot reach the vulnerable path - and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is correspondingly low at 0.11% (2nd percentile).
An out-of-bounds read in ReadDataElement (common.c) within the Android platform allows a locally installed application to disclose sensitive memory contents without any additional execution privileges or user interaction. The flaw is a missing/incorrect bounds check on an attacker-influenced length or index value, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N), so the practical impact is confidentiality loss rather than code execution. Affected builds are Android platform components referenced by the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is absent from the supplied data.
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
Local privilege escalation in the Android kernel's address remapping code (addr_remap_address_map in remap.c) allows an attacker who already holds System-level execution privileges to further elevate their access on the device. The flaw is a logic error in mapping validation that constitutes a protection-mechanism failure (CWE-693); successful exploitation requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N), with no user interaction, and yields high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS is negligible at 0.12% (2nd percentile), and fixes are bundled into Google's 2026-09-01 Android/Pixel security bulletin, making this a genuine but bounded issue rather than a top-tier emergency.
Local privilege escalation in the Android kernel lets an attacker who already holds System-level execution privileges bypass a permission check and extend that access further on affected Pixel devices covered by the September 2026 Android Security Bulletin. The flaw is a logic error in permission handling (CWE-693) that requires no user interaction but is gated behind the high precondition of pre-existing System execution context (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7), making it a privilege-boundary bypass chained after an initial compromise rather than a standalone entry point. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment of a genuinely low-priority, locally-scoped issue.
A logic error in the Android kernel's VPU (Video Processing Unit) driver can disclose kernel memory contents to code that is already running with System-level privileges. The flaw is local-only: CVSS gives AV:L with PR:H, so an attacker must first obtain elevated (System) execution on the device before triggering the information leak, and no user interaction is required once that precondition is met. There is no public exploit code and no CISA KEV listing at time of analysis, and the associated EPSS data was not supplied, so this should be treated as a post-compromise information-disclosure primitive rather than a remotely exploitable issue.
Local privilege escalation in the Android bootloader lets a caller that already holds System execution privileges bypass a missing permission check and reach higher-privileged bootloader operations on affected Android devices. The CVSS vector (AV:L/PR:H/UI:N) makes clear this is a second-stage escalation that requires both local access and an existing high-privileged foothold, not a remote or unprivileged-app vector, and it needs no user interaction. Google resolves it through the September 2026 Android/Pixel security bulletin; EPSS is very low (0.11%, 2nd percentile) and no public exploit has been identified at time of analysis.
Local privilege escalation in Google Android's image authentication service (image-auth-srv.c) allows a component that already holds System execution privileges to abuse a logic error in the gsa_sw_pk_hash_compare public-key hash-comparison routine, achieving escalation into a more trusted execution context. The flaw is reachable only locally (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), so it is not an initial-access or remote vector. Exploitability signals are weak: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the practical risk is a defense-in-depth weakness affecting Pixel/Android builds that ship the affected image authentication service.
Local privilege escalation in the Android kernel's ac_init_one_sswrp() initialization routine (init.c) allows an attacker who already holds System execution privileges on an affected Android/Pixel device to escalate further by abusing a logic error in the code, with no user interaction required. Because the assessed vector is AV:L/PR:H, this is a post-compromise escalation primitive rather than a remote or unauthenticated entry point - the pre-existing System-level foothold is the primary limiting factor, which sharply narrows realistic exploitation to attackers who have already breached a highly privileged process. No public exploit code or CISA KEV listing was identified at time of analysis, EPSS is very low (0.12%, roughly the 2nd percentile), and Google has shipped a fix in the September 2026 Pixel bulletin (2026-09-01) - consistent with a genuine but low-priority issue.
Local privilege escalation in the Android Bootloader lets an attacker who already holds System-level execution privileges (PR:H) bypass a missing permission check on an exposed bootloader interface and escalate to higher integrity, confidentiality, and availability impact on the device. Exploitation is local only (AV:L), requires no user interaction (UI:N), and is confined to post-compromise escalation of a privilege boundary on affected Pixel/Android firmware, which is why the assessed severity is moderate (CVSS 6.7) despite high C/I/A ratings. EPSS is very low at 0.12% (2nd percentile), no public exploit code exists, and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; Google's September 2026 Pixel security bulletin covers the fix.
An out-of-bounds read in the AES-GCM-256 crypto implementation of the Android kernel (function do_sss_aes_gcm_256_op in crypto-aes.c) allows disclosure of memory contents to code that is already running at System privilege on an affected device. The flaw is a missing bounds check on an input length or index (CWE-120 class buffer handling error), rated 4.4 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation is local and requires the attacker to already hold System (PR:H) execution privileges; no user interaction is needed once that position is held. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the entry point sits behind a high privilege boundary the practical risk is a post-compromise or chained privilege-escalation information leak rather than an independent remote threat.
Stored Cross-Site Scripting in the web backend of Repetico 1.9.7.31 for Android allows an authenticated remote user to inject and execute arbitrary JavaScript in other users' app contexts by embedding a malicious payload in a multiple-choice question text field. The CVSS Scope:Changed metric confirms the injected script can affect victim users beyond the attacker's own session, enabling session hijacking, credential theft, or unauthorized in-app actions. A researcher-published PoC writeup on GitHub confirms the attack path. No vendor patch or advisory has been identified at this time.
Double-free in the Samsung Exynos Display Processing Unit (DPU) kernel driver allows a local low-privileged attacker to corrupt kernel heap memory and trigger a use-after-free condition across nine Exynos chip families spanning mid-range to flagship Samsung devices. Exploitation requires meeting a high-complexity timing condition during DMA buffer reallocation in the DPU driver, limiting practical attack surface despite the kernel-level impact. No public exploit code exists and this CVE has not been added to the CISA KEV catalog at the time of analysis.
Heap overflow via TOCTOU race in the Exynos DRM HDR Driver affects Samsung Mobile Processors across nine Exynos SoC generations (1280, 2200, 1380, 1480, 2400, 1580, 2500, 1680, and 2600), enabling a local low-privileged attacker to crash the kernel. The race condition occurs in the Display Processing Unit's HDR handling path, where a check-then-use window can be exploited to corrupt kernel heap memory, resulting in a denial-of-service condition. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present.
Sensitive credential information leak in the Passwords component of Google Chrome on Android (prior to 153.0.8010.36) enables a remote unauthenticated attacker to extract password data by luring a victim to a crafted HTML page. Despite Chromium classifying the severity as 'Low', the NVD CVSS vector assigns C:H reflecting that full credential disclosure is possible. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.21% (11th percentile) signals low automated exploitation pressure at time of analysis.
Missing authorization (CWE-862) in Chrome's WebView component on Android prior to 153.0.8010.36 allows remote attackers to bypass Android system access restrictions through crafted network traffic. Exploitation is gated behind social engineering - the attacker must trick a user into interacting with malicious content, yielding a high integrity impact but no confidentiality or availability consequence. Chromium's own team rated this 'Low' severity, a notable divergence from the NVD CVSS 6.5, and no public exploit or active exploitation has been identified.
Improper input validation in the Safebrowsing component of Google Chrome on Android prior to 153.0.8010.36 enables a remote attacker to bypass system access restrictions through a crafted HTML page. Exploitation requires social engineering to direct an Android Chrome user to the malicious page (UI:R), limiting opportunistic attack surface. No public exploit code has been identified and EPSS is very low (0.22%, 13th percentile), though the integrity-only CVSS 6.5 accurately reflects a meaningful access restriction bypass on a ubiquitously deployed browser. Vendor-released patch is available in Chrome 153.0.8010.36.
Google Chrome's Downloads subsystem on Android prior to 153.0.8010.36 improperly enforces its behavioral workflow (CWE-841), allowing a remote attacker to bypass Android system access restrictions via a crafted HTML page combined with social engineering. The attacker achieves high integrity impact - likely the ability to write files or trigger downloads that circumvent Android's permission and access control model - without any confidentiality or availability exposure. No public exploit exists and EPSS sits at 0.22% (13th percentile), placing real-world exploitation risk low despite the network-accessible attack vector.
Out-of-bounds read in Android's 802.11be (WiFi 7 / EHT) parsing code exposes kernel or userspace memory to adjacent attackers across all currently supported Android releases (14, 15, 16, 16-QPR2, and 17). The flaw resides in get_eht_operation_channel_width() within ieee802_11_common.c, where an incorrect bounds check allows a crafted EHT Operation element - delivered via a rogue access point - to read past the end of a buffer, leaking memory contents to the attacker. With EPSS at 0.12% and no KEV listing, real-world exploitation is not currently observed, but the adjacency-only prerequisite makes this relevant to targeted or physical-proximity attacks.
Local information disclosure in Android's AppFuseBridge framework component allows any installed app to read files or data it lacks permission to access. The vulnerability exists in the openFile() method of AppFuseBridge.java, where a missing permission check (CWE-693) permits a low-privileged local process to bypass access controls without user interaction. Affected versions span Android 14 through 17, including the QPR2 interim release, giving this issue a broad footprint across current Android deployments. No public exploit or active exploitation has been identified; EPSS is 0.12% (2nd percentile), consistent with the local-only, low-impact nature of the flaw.
Local information disclosure in Android 15 through 17 exploits a confused deputy flaw in `screenArgsForPermissionCheckIfAny`, allowing a low-privileged local app to bypass permission validation and access data it should not be authorized to read. The flaw stems from a privileged component incorrectly acting on behalf of a less-privileged caller without adequate permission verification, resulting in unauthorized local data exposure. No public exploit has been identified at time of analysis, and with an EPSS of 0.12% this is assessed as low-priority despite Android's broad deployment footprint.
Missing permission check in multiple functions of RangingServiceImpl.java on Android enables a man-in-the-middle attacker to intercept ranging service communications and disclose sensitive information without requiring additional execution privileges. Affected versions span Android 16, Android 16-QPR2, and Android 17, covering current and near-future Android releases. No public exploit has been identified at time of analysis, and EPSS is very low at 0.14%, but the network-reachable attack surface and absence of user interaction required warrant attention in environments handling proximity or location-sensitive data.
Local information disclosure in Android 14 through 17 stems from a logic error across multiple functions in XmpDataParser.java that causes improper sanitization of XMP metadata during media file parsing. A local attacker with standard user-level privileges can trigger the flaw without any user interaction, leaking restricted information from the parsing context. No public exploit code or active exploitation has been identified, and the September 2026 Android Security Bulletin provides the authoritative patch.
Persistent local denial of service in Android's VoiceInteractionManagerService affects versions 14 through 17 via resource exhaustion in the initForUserNoTracing method. A low-privilege local attacker - such as a malicious installed app - can exhaust system resources without any user interaction, rendering the device persistently unavailable. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with limited real-world exploitation interest.
Tapjacking via malicious UI overlay in Android 17's ContactsPickerActivity allows a locally installed application to present misleading UI over the contacts picker, resulting in local information disclosure of contact data. The attack requires only low-privilege access (a sideloaded or installed app) and no user interaction once the overlay is active. No public exploit code is identified, and EPSS at the 2nd percentile reflects negligible opportunistic exploitation probability.
Bluetooth encryption downgrade in Android's `btm_sec_encrypt_change` function (btm_sec.cc) exposes information on Android 17 and Android 16-QPR2 devices by allowing a logic error in encryption change handling to be exploited without user interaction. A Bluetooth-adjacent attacker with a low-privilege connection can trigger the downgrade, reducing encryption strength and enabling passive interception of Bluetooth traffic. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.16%, indicating very low observed exploitation probability.
Local information disclosure in Android 16 and 17 exposes the device Bluetooth MAC address through a missing permission check in the writeToParcel method of BleRssiRangingCapabilities.java. Any low-privileged local application can invoke this code path without holding the required Bluetooth permission, silently retrieving a hardware identifier that can be used to track a device across networks. No public exploit has been identified at time of analysis, and CISA SSVC assessment places exploitation at none.
Location metadata disclosure in Android 17's MediaProvider component allows a low-privileged local app to bypass permission enforcement in getQueryBuilderInternal of MediaProvider.java and retrieve GPS coordinates embedded as EXIF metadata in media files without holding the ACCESS_MEDIA_LOCATION permission. The root cause is CWE-862 (Missing Authorization) in the query builder logic - the authorization gate that should block location-tagged media queries from unpermissioned callers is absent or incorrectly applied. No public exploit has been identified, and the CVSS 3.3 score reflects both the constrained local attack surface and the limited disclosure scope.
Persistent denial-of-service in Android's WifiNetworkSuggestionsManager affects versions 15 through 17, including 16-QPR2. The `add` method in WifiNetworkSuggestionsManager.java fails to enforce resource consumption limits (CWE-400), allowing a low-privileged local application to exhaust system resources and render the device unresponsive or degraded without any user interaction. No confidentiality or integrity impact exists; the risk is purely availability-based, but the 'persistent' characterization implies the DoS survives reboots or normal recovery paths.
Permanent local denial of service in Android's GameManagerService affects devices running Android 14 through 16-qpr2, exploitable by any low-privilege application without user interaction. The vulnerable code path - `parseInterventionFromXml` in `GameManagerService.java` - fails to bound resource consumption during XML parsing of game mode intervention data, allowing a locally installed app to exhaust system resources and render the service permanently unavailable until device reboot. No public exploit has been identified; the September 2026 Android Security Bulletin addresses this vulnerability.
Permanent local denial-of-service in Android's PackageInstallerService allows a low-privilege local attacker to irreversibly disable an affected device through a logic error in the createSessionInternal session-creation path. Affected releases are Android 16-qpr2 and Android 17, as confirmed by Google's September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the monthly Android security update.
Unauthorized access to and modification of device credentials is possible in Android 14 through 17 due to a missing permission check in the `onCreate` method of `ConfirmDeviceCredentialActivity.java`. Any locally installed application running with standard user-level privileges can trigger this flaw without requiring user interaction, gaining read access to - and potentially altering - stored device credential state. No public exploit code exists and EPSS sits at 0.11% (2nd percentile), placing current real-world exploitation risk very low despite the breadth of affected Android versions.
Local information disclosure in Android 14-16 allows any installed app with basic privileges to read wallet contextual location data by calling WalletContextualLocationsService without a working authorization gate. The root cause is a missing permission check in the isCallerAllowed method of WalletContextualLocationsService.kt (CWE-862): the service fails to verify that the caller holds the required wallet-access permission before returning location context. Impact is limited to confidentiality of wallet location data; no code execution, integrity modification, or privilege escalation is possible. No public exploit code has been identified and EPSS is 0.11% (2nd percentile), reflecting negligible current exploitation interest.
Path traversal in Adobe Photoshop Mobile for Android (≤1.6.0.2294 and ≤1.6.0.2299) enables a low-privileged attacker to cause a security feature bypass, reading unauthorized files or directories outside the app's intended sandbox and producing high availability impact when a victim opens a maliciously crafted Photoshop document. The CVSS 3.1 score of 5.0 captures the meaningful constraints: local attack vector, high complexity, required user interaction, and the fact that exploitation depends on conditions beyond the attacker's control. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis.
Origin validation error (CWE-346) in Microsoft Teams for Android enables an authenticated network attacker with user interaction to disclose sensitive cross-origin information. Affecting all versions prior to 1416/1.0.0.2026142702, the flaw allows a malicious origin to extract data that the Teams application fails to properly restrict, resulting in a scope-changed confidentiality breach rated C:H by Microsoft. No public exploit has been identified at time of analysis, and a vendor patch is available.
Microsoft Teams for Android before build 1416/1.0.0.2026133602 inserts sensitive information into outbound network transmissions (CWE-201), enabling a low-privileged authenticated attacker to intercept and read confidential data over the network when a victim user performs an in-app action. The CVSS scope change (S:C) with high confidentiality impact (C:H) signals that the leaked data can cross trust boundaries beyond the attacker's own session, potentially exposing other users' or sessions' sensitive material. No public exploit identified at time of analysis; Microsoft has released a patch via the MSRC advisory.
Local privilege escalation in MediaTek's Audio Hardware Abstraction Layer (HAL) on Android devices allows an attacker who already holds System-level privilege to further escalate access through improper input validation, achieving full confidentiality, integrity, and availability compromise of the affected device. The vulnerability spans 57 distinct MediaTek chipsets across the MT6xxx and MT8xxx families and is addressed in MediaTek's September 2026 security bulletin under Patch ID ALPS11087540 (Issue ID: MSV-8246). No public exploit code or active exploitation has been identified at time of analysis, and EPSS places exploitation probability at 0.13%.
Memory corruption via use-after-free in the Android SurfaceFlinger graphics compositor, present on specific MediaTek chipsets (MT6881, MT6993, MT6858, MT8668), enables a local attacker who has already obtained System-level privilege to escalate to higher privileges - potentially root or kernel - without any user interaction. Reported by MediaTek in the September 2026 Security Bulletin under Patch ID ALPS11123860 and Issue ID MSV-8890. No public exploit has been identified at time of analysis, and CISA SSVC rates exploitation status as none and automatable as no, consistent with the high-privilege prerequisite.
Privilege escalation via a double-free memory corruption bug in camera middleware affects 17 MediaTek chipset variants, allowing an attacker who has already gained System-level privilege to escalate further to higher privilege tiers without any user interaction. The flaw is confirmed by MediaTek in their September 2026 Product Security Bulletin under Patch ID ALPS11134622 and Issue ID MSV-8894. No public exploit code or active exploitation is confirmed; SSVC designates this as non-automatable with no current exploitation activity.
MiracastService on MediaTek Smart TV and DTV chipsets exposes a confused deputy condition (CWE-926) that allows a local app running with user-level privileges to trigger a denial-of-service against the Wi-Fi Display subsystem. The flaw stems from an improperly exported Android application component that lets an unprivileged caller invoke MiracastService capabilities without holding the necessary permissions, crashing or disabling the service. No public exploit code exists and SSVC rates exploitation as none, placing this firmly in the routine patch tier with a vendor-confirmed CVSS 5.5.
Web origin policy bypass in Google Chrome for Android (prior to 152.0.7977.82) exploits a use-of-released-resource flaw (CWE-672) in the browser's mobile implementation, allowing cross-origin content manipulation via a crafted HTML page. An attacker must socially engineer a victim into visiting the malicious page, after which Chrome's Same-Origin Policy enforcement can be circumvented, resulting in high integrity impact against targeted origins. No public exploit code or CISA KEV listing exists at time of analysis; Google issued a fix in stable channel release 152.0.7977.82.
Local information disclosure in Android Verified Boot (AVB) allows an attacker with local access to read a small amount of out-of-bounds memory by supplying malformed RSA key data to the iavb_parse_key_data function in avb_rsa.c. The vulnerability affects Google Android devices (CPE: cpe:2.3:a:google:android) and requires local access, no additional execution privileges (PR:N), and no user interaction (UI:N) per the CVSS vector (AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). No public exploit code or active exploitation has been identified at time of analysis (EPSS 0.09%, 1st percentile; CISA SSVC exploitation: none), and the impact is limited to confidentiality (C:L) with no integrity or availability effect.
An out-of-bounds read in Android's RTCP APP packet decoder (decodeAppPacket in RtcpAppPacket.cpp) allows a remote party to a media session to read a limited amount of adjacent memory and disclose that information, with no code execution, integrity, or availability impact. Affected are Android/Pixel builds prior to the 2026-06-01 security patch level; the flaw is remotely reachable without authentication and without user interaction (CVSS 3.1 AV:N/AC:L/PR:N/UI:N, confidentiality impact Low only), though the practical precondition is that the attacker be a participant in, or able to inject packets into, an active RTP/RTCP media session handled by the vulnerable parser. There is no CISA KEV entry, no publicly available exploit code identified at time of analysis, and EPSS is only 0.20% (9th percentile), so exploitation likelihood is very low despite the network attack vector.
An out-of-bounds read in Android's RTP media stack, specifically in RtpPacket::decodePacket, can leak a small amount of adjacent memory to a remote party that delivers a crafted RTP packet while the device is participating in a media or VoIP session. Exploitation requires no privileges (CVSS PR:N) but does require the victim to engage in the RTP session (UI:R), and the resulting impact is limited to partial confidentiality loss (C:L) with no code execution, integrity, or availability effect. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and EPSS is low at 0.18% (8th percentile); CISA SSVC rates exploitation as none and the issue as not automatable.