Monthly
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before. Rated medium severity (CVSS 6.9). Public exploit code available and EPSS exploitation probability 12.0%.
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.1%.
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 76.4%.
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 76.3%.
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.3%.
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 74.6%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.8%.
Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 27.8%.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.7%.
Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.1%.
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 16.3%.
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execution, exploited in the wild via Flash content embedded in Microsoft Office documents and web pages.
Qt6 WebEngine (qt6-qtwebengine) on Alpine Linux has been patched in package version 6.10.1-r7, addressing an unspecified vulnerability. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence - no CVE description, CVSS score, CWE classification, or vendor advisory narrative has been published at time of analysis. Alpine Linux is the sole reporting source, and the fix is confirmed present in the Alpine package repository at version 6.10.1-r7.
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmem_invalidate_range() call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being invalidated, e.g. is being PUNCH_HOLE'd. Use the same core logic to handle invalidations as VMX does for the APIC-access page, as the two concepts are nearly identical: shove the physical address of a page into the vCPU's control structure: 1. Snapshot the invalidation sequence counter 2. Grab the pfn (from guest_memfd in this case) 3. Acquire mmu_lock for read 4. Re-request reload if retry is needed, otherwise commit the change. Note, the re-request action in #4 is necessary as KVM's retry logic is fuzzy, i.e. can get false positives. If the guest_memfd page has been dropped, at some point a subsequent reload will fail to get a PFN from guest_memfd, and KVM will fail KVM_RUN. If the retry was due to a false positive, KVM will retry until there are no relevant MMU notifier events (and will retry in the "outer" loop, i.e. will drop locks and resched as needed). Note #2! Take care to invalidate the VMSA when a relevant memslot is DELETED or MOVED, as invalidations in response to PUNCH_HOLE are predicated on memslot bindings (KVM doesn't know what GFN range(s) to invalidate without a binding). And more importantly, the VMSA mapping requires a memslot, i.e. must be invalidated if its memslots disappears, regardless of the state of the underlying guest_memfd inode. Failure to invalidate the vCPU's control.vmsa_pa (which is checked by pre_sev_run()) can prevent KVM from properly freeing the page as firmware will reject the RMPUPDATE to reclaim the page with FAIL_INUSE if the vCPU is actively running, i.e. if VMSA page is in-use. That in turn leads to an RMP #PF on the next use, as the page will still be assigned to the SNP VM. SEV-SNP: RMPUPDATE failed for PFN 78d198, pg_level: 1, ret: 3 SEV-SNP: PFN 0x78d198, RMP entry: [0xfff0000000144001 - 0x000000000000000f] CPU: 3 UID: 0 PID: 31345 Comm: sev_snp_vmsa_pu Tainted: G U O Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026 Call Trace: <TASK> dump_stack_lvl+0x54/0x70 rmpupdate+0x12c/0x140 rmp_make_shared+0x3b/0x60 sev_gmem_invalidate+0xe0/0x170 [kvm_amd] delete_from_page_cache_batch+0x1d8/0x220 truncate_inode_pages_range+0x120/0x3d0 kvm_gmem_fallocate+0x19a/0x270 [kvm] vfs_fallocate+0x1bc/0x1f0 __x64_sys_fallocate+0x48/0x70 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x496c7e </TASK> ------------[ cut here ]------------ SEV: Failed to update RMP entry for PFN 0x78d198 error -14 WARNING: arch/x86/kvm/svm/sev.c:5160 at sev_gmem_invalidate+0x126/0x170 [kvm_amd], CPU#3: sev_snp_vmsa_pu/31345 CPU: 3 UID: 0 PID: 31345 Comm: sev_snp_vmsa_pu Tainted: G U O Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026 RIP: 0010:sev_gmem_invalidate+0x12b/0x170 [kvm_amd] Call Trace: <TASK> delete_from_page_cache_batch+0x1d8/0x220 truncate_inode_pages_range+0x120/0x3d0 kvm_gmem_fallocate+0x19a/0x270 [kvm] vfs_fallocate+0x1bc/0x1f0 __x64_sys_fallocate+0x48/0x70 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x496c7e </TASK> irq event stamp: 20689 hardirqs last enabled at (20699): [<ffffffff8e76092c>] __console_unlock+0x5c/0x60 hardirqs last disabled at (20708): [<ffffffff8e760911>] __console_unlock+0x41/0x60 softirqs last enabled at (20722): [<ffffffff8e6cd74e>] __irq_exit_rcu+0x7e/0x140 softirqs last disabled at (20717): [<ffffffff8e6cd74e>] __irq_exit_rcu+0x7e/0x140 ---[ end trace 0000000000000000 ]--- BUG: unable to handle page fault for address: ffff99 ---truncated---
Local attackers with authenticated access can retrieve cleartext-stored credentials from the Fermax DuoxMe Android app versions prior to 4.3.4 and impersonate the user account. This CWE-312 vulnerability requires local access to the device, and on non-rooted devices the app sandbox normally protects the data, so root or device-level access is the practical prerequisite. No public exploit code has been identified at time of analysis, and the risk is assessed as a modest-severity local issue.
Use-after-free in Chrome's Skia graphics library allows an attacker who has already compromised the renderer process to read cross-origin data after a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. Chromium rates the bug High severity because it can breach the same-origin boundary, even though the CVSS base score is only 3.1 (confidentiality-limited, no integrity or availability impact). No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the attack is not automatable per CISA's SSVC assessment.
An integer overflow in Google Chrome's Compositing component (fixed in 153.0.8010.47) lets a remote attacker leak cross-origin data by getting a victim to open a crafted HTML page. Exploitation requires user interaction (the victim must load the page) but no authentication or elevated privileges, and the impact is limited to confidentiality - integrity and availability are unaffected per the CVSS vector. There is no public exploit code or CISA KEV listing at time of analysis, and the CVSS base score is only 4.3, so this is a browser-patching hygiene issue rather than an emergency incident response trigger.
Let me construct the JSON. CVE-2026-91744: Chrome on Mac, race condition in PlatformIntegration, renderer compromise + social engineering, info disclosure, CVSS 5.3, CWE-367. Let me write fields carefully. Product name: "Google Chrome" — 1-3 words. Or "Google Chrome (macOS)". Keep "Google Chrome". Summary: must not start with "A vulnerability". Start with impact verb + product. Info disclosure in Google Chrome for macOS prior to 153.0.8010.47... Race condition in PlatformIntegration component. Requires attacker to already have compromised renderer process and use social engineering (UI:R). CVSS 5.3. No KEV, no POC identified. Technical context: PlatformIntegration is macOS-specific integration layer (native macOS APIs, app bindings, drag-and-drop, services, etc.). CWE-367 TOCTOU race condition — check and use of resource with different timing, enabling a race window where a resource's state changes between check and use, allowing access to data not intended for the renderer. Chrome's multi-process architecture & site isolation — renderer compromise is assumed by Chrome's threat model. The flaw crosses the sandbox boundary in the sense that the renderer-obtained access to macOS integration surfaces yields sensitive info. Risk assessment: CVSS 5.3 moderate, AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. AC:H reflects the race condition timing win. UI:R because social engineering. PR:N per the vector — unauthenticated. Requires a compromised renderer, which raises the practical bar considerably: a separate renderer exploit is needed first. EPSS not provided — state missing. KEV not listed. No POC identified. Include "radom" once, naturally, in one sentence as illustrative hypothetical mid-sized operator. Affected products: Google Chrome on macOS prior to 153.0.8010.47. EUVD lists Chrome 153.0.8010.47 <153.0.8010.47 (odd formatting). References: chromereleases blog, chromium issue 520019273. CPE not provided — state that. Remediation: upgrade to 153.0.8010.47 or later (Ch
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
Uninitialized memory handling in the Skia graphics library shipped with Google Chrome before 153.0.8010.47 lets a remote attacker leak cross-origin data when a victim opens a crafted HTML page. Exploitation is unauthenticated but requires the user to visit attacker-controlled content (UI:R), and impact is limited to partial confidentiality loss with no integrity or availability effect (CVSS 4.3). Google has released a stable-channel fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
UI spoofing in Google Chrome's Transactions Platform component lets a remote attacker who has already compromised the browser's renderer process render crafted HTML as trusted interface elements, deceiving the user. The flaw is a missing authorization check (CWE-862) affecting Chrome versions prior to 153.0.8010.47, and it is not reachable on its own: exploitation requires a separate, earlier renderer compromise plus the victim loading and interacting with the attacker's page (UI:R, AC:H). Impact is limited to low-severity confidentiality and availability effects rather than code execution or sandbox escape, no public exploit code was identified at time of analysis, and the issue is fully resolved by Chrome 153.0.8010.47.
Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Cross-origin data disclosure in Google Chrome versions prior to 153.0.8010.47 occurs when an attacker who has already compromised the renderer process lures a victim to a crafted HTML page. The weakness lives in the GetUserMedia media-capture code path, where incomplete cleanup (CWE-459) leaves cross-origin data recoverable, as captured by the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N (score 3.1) - unauthenticated network reach but high attack complexity, mandatory user interaction, and confidentiality-only, low-magnitude impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped the fix in Chrome 153.0.8010.47.
Google Chrome for Android versions prior to 153.0.8010.47 contain an out-of-bounds read in the WebGL rendering path that allows a remote attacker to leak memory from outside the browser sandbox by luring a victim into opening a crafted HTML page. Google labels the Chromium security severity as Critical, while the published CVSS 3.1 base score is a comparatively modest 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) because the flaw yields a limited confidentiality leak rather than code execution or data modification. A vendor patch is available, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Information disclosure in Google Chrome desktop builds prior to 153.0.8010.47 allows a remote attacker to leak sensitive data by measuring observable CSS rendering discrepancies induced by a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires the victim to open the attacker-controlled page (UI:R), and the leak depends on high-attack-complexity side-channel measurement rather than a deterministic parsing bug, so the impact is limited to confidentiality with no integrity or availability effect. The issue is rated Medium by Chromium; no public exploit code has been identified at time of analysis, and Google has released a fixed build.
Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
An uninitialized-resource flaw (CWE-908) in ANGLE, the graphics translation layer used by Chrome to render WebGL and accelerated 2D content, is present in Google Chrome builds prior to 153.0.8010.47. A remote attacker who convinces a user to open a crafted HTML page can cause ANGLE to return memory contents that were never initialized, disclosing data that is outside Chrome's sandbox boundary — an information-disclosure primitive rather than a code-execution bug. Google rates the issue High severity (Chromium) and has published a fixed build; the NVD CVSS score is 4.7 and there is no CISA KEV entry or identified public exploit code at time of analysis.
Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Information disclosure in Google Chrome for Android before 153.0.8010.47 allows a locally installed app on the same device to retrieve sensitive browser data because an authorization check is missing on an Android-exposed Chrome component. The flaw is local-only and rated AC:H, giving a modest CVSS 3.1 base of 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) even though the confidentiality impact is complete; Google's Chromium team nevertheless classifies it as High severity. Google has shipped a fix in 153.0.8010.47, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Information disclosure in Google Chrome builds prior to 153.0.8010.47 allows a remote, unauthenticated attacker to leak sensitive data from the victim's browser by measuring font-related observable discrepancies on a crafted HTML page, a technique that requires the victim to be socially engineered into loading that page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.3). Impact is confidentiality-only, with no integrity or availability effect, and the high attack complexity reflects the probabilistic nature of the CWE-203 side channel, so reliable exfiltration demands specific conditions rather than a single deterministic request. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; Google has shipped a vendor-released patch in Chrome 153.0.8010.47, and auto-updating installations at or above that version are not affected.
UI spoofing in Google Chrome versions prior to 153.0.8010.47 allows an attacker who has already compromised the browser's renderer process to draw convincing but fake interface elements in front of the user via a crafted HTML page. The flaw is a missing authorization check (CWE-862) on a browser-side privileged capability, rated Medium by the Chromium team and scored 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L), with impact limited to Low confidentiality and Low availability and no integrity effect. Exploitation is not possible as a standalone initial-access vector - renderer compromise is a mandatory precondition, user interaction is required, and attack complexity is High; no CISA KEV listing and no public exploit code were identified at time of analysis. A vendor-released patch exists in Chrome 153.0.8010.47.
Cross-origin data disclosure in Google Chrome prior to 153.0.8010.47: a race condition (TOCTOU) in the browser's Network component lets a remote attacker who has already achieved code execution inside the renderer process read data belonging to other origins by luring a victim to a crafted HTML page. The impact is limited to confidentiality of cross-origin responses (C:L, I:N, A:N), and exploitation is rated High complexity with required user interaction; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the vendor has shipped a fix in 153.0.8010.47.
An out-of-bounds write in the Android kernel GNSS link driver lets a local process that already holds System execution privileges corrupt kernel memory and escalate to kernel-level code execution. The defect (CWE-787) is a missing bounds check in link_load_gnss_image() in link_device.c, requires no user interaction, and is addressed through Google's September 2026 Android/Pixel security bulletin. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in the arm-smmu-v3 driver of Google's Android kernel lets code already running with System privileges bypass the ARM SMMUv3 protection mechanism and reach higher-level (kernel/root) execution on affected ARM-based devices, including Pixel. The root cause is a logic error classified as CWE-693 (Protection Mechanism Failure), reachable without any user interaction but only from a local, already-privileged context (CVSS PR:H). No public exploit code and no active exploitation have been identified at time of analysis, so this is a monthly-bulletin hardening fix rather than an emergency patch.
Local privilege escalation in Google Android's GPU driver component allows a process that already runs with System execution privileges to bypass a permission check through a logic error, gaining full read/write/execute impact at a higher privilege level. Only Android devices carrying the affected GPU component are exposed, and exploitation is strictly local with no user interaction, so it cannot be triggered by a remote attacker or a normal unprivileged app on its own. There is no public exploit code and no CISA KEV listing identified at time of analysis; remediation is delivered through the September 2026 Android/Pixel security bulletin.
Local privilege escalation in the Android kernel's arm-smmu-v3 driver (smmu_install_nested_ste) lets a process that already runs with System execution privileges turn a logic error in SMMU stream-table-entry handling into full kernel-level compromise of confidentiality, integrity, and availability. Only devices whose kernel exposes the ARM SMMUv3 driver in a nested-translation configuration are affected, and Google rates it Moderate with a CVSS base of 6.7 (AV:L/PR:H), meaning exploitation presupposes a highly privileged local foothold rather than remote or unauthenticated access. There is no indication of public exploit code and the issue is not listed in CISA KEV; Google's Pixel bulletin of 2026-09-01 ships the fix.
A use-after-free in the ARM SMMU v3 driver (arm-smmu-v3.c) of the Android kernel lets a local attacker who already holds System-level execution privileges corrupt kernel memory and escalate to full kernel/System privilege. The flaw is a logic error in one of several driver functions that leaves a freed object reachable, and no user interaction is needed once the attacker has code running at that privilege level. It is ranked CVSS 6.7 (AV:L/PR:H), there is no indication of active exploitation or public exploit code, and Google published a fix in the September 2026 Pixel security bulletin.
A logic error in the ARM SMMU v3 driver's smmu_detach_dev path allows a caller who already holds System-level privileges on an Android device to bypass SMMU/IOMU memory-permission checks and escalate to kernel (EL1) execution, achieving full compromise of the device. Affected are Google Pixel/Android builds using the arm-smmu-v3 driver prior to the September 2026 Android Security Bulletin patch level. Exploitation is local, requires no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis, so the practical risk is concentrated on devices that already run privileged or partially compromised code.
A confused-deputy flaw (CWE-441) in the Android platform's message-handler initialization routine, platform_msg_handler_init in default_msg_handlers.c, lets a local process that already runs with System privileges have privileged operations performed on its behalf by a more trusted component, resulting in local privilege escalation with high impact to confidentiality, integrity and availability. Exploitation requires local execution at the System privilege level (CVSS PR:H) and no user interaction, so it is not reachable by an ordinary unprivileged app. There is no public exploit code identified and the issue is not in CISA KEV; it was published through the September 2026 Android/Pixel security bulletin, so risk to most users is conditional on already having a System-level foothold or being part of an exploit chain.
An out-of-bounds read in the Pixel-specific physmem_extmem driver (physmem_extmem_linux.c) of the Android kernel lets a local process with low privileges read kernel memory that was never initialized, exposing potentially sensitive data. No user interaction or elevated execution privileges are required, and the impact is limited to confidentiality (CVSS 5.5, AV:L/PR:L/C:H). The issue is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified at the time of analysis.
A missing permission check in the FSM key-release routine (FsmReleaseKey in fsm.c) of the Android kernel allows a locally positioned attacker to bypass an access-control verification and escalate privileges on affected devices. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is classified as CWE-693, Protection Mechanism Failure, because the intended permission gate is simply not enforced on that code path. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no public exploit code or CISA KEV entry has been identified at time of analysis.
Uninitialized memory use in multiple locations of the Android kernel allows a locally-positioned attacker who already holds System-level execution privileges to read stale kernel memory contents, resulting in information disclosure. The flaw is rated CVSS 4.4 (AV:L/PR:H) and affects Android builds covered by the September 2026 Pixel/Android Security Bulletin; user interaction is not required. No public exploit code and no CISA KEV listing were identified at time of analysis, and the exploitation prerequisite of pre-existing System privileges keeps the practical risk confined to post-compromise or privileged-local scenarios.
Local escalation of privilege in the Android kernel's ARM SMMU v3 driver lets a process that already runs with System privileges reach kernel-level code execution by passing malformed input to the nested device-detach path (smmu_detach_dev_nested in arm-smmu-v3.c). Because the CVSS vector requires PR:H, this is not a boundary an ordinary unprivileged app can cross — it is a second-stage escalation for code that already holds highly privileged, kernel-adjacent access on the device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so risk is driven by the monthly Android/Pixel kernel patch cycle rather than by observed attacks; no EPSS score was supplied in the input data.
A time-of-check to time-of-use (TOCTOU) race condition in multiple locations of the Android kernel allows an attacker who already holds System-level execution privileges on a device to win a timing window and escalate to higher (kernel/root) privileges, with no user interaction required. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is fixed through the September 2026 Android Security Bulletin for Pixel devices. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied, so the practical risk is concentrated in post-compromise privilege escalation rather than remote mass exploitation.
Local privilege escalation in the Android kernel's PMIC inter-process-communication driver (ap_pmic_ipc.c) lets a caller that already holds System execution privileges bypass permission checks via a confused-deputy flaw in ap_pmic_poll_msg_handler and gain kernel-level code execution. Only Android devices that carry the affected PMIC IPC driver — the Google Pixel bulletin of 2026-09-01 is the vendor reference, and the CPE scopes this to google:android — are exposed, and the attacker must already be running with elevated (System) privileges on the device. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this reads as a post-compromise escalation primitive rather than a remotely reachable entry point.
Local privilege escalation in Google Android/Pixel arises from a permission bypass in the DreamPickerReceiver.kt component (the Daydream/screensaver picker), where a confused-deputy flaw lets a locally installed application reach privileged operations that execute with System privileges. Affected are Android/Pixel builds at security patch levels prior to the 2026-09-01 bulletin; exploitation requires the attacker to already have local code execution via a malicious or compromised app, and no user interaction is needed once that app is present. The issue is fully local (AV:L) with no remote or network reach, no public exploit code has been identified at time of analysis, and devices carrying the 2026-09-01 patch level are not exposed.
An out-of-bounds write in the Android kernel, caused by a missing bounds check, allows an attacker who already holds System-level execution privileges on a device to corrupt kernel memory and escalate to full kernel/root privileges. The flaw is reachable only with local access (AV:L, PR:H) and requires no user interaction, and the associated CVSS score of 6.7 reflects high integrity, confidentiality and availability impact rather than ease of reach. No public exploit code or CISA KEV active-exploitation listing was provided in the available intelligence, so this is currently assessed as a patch-priority local privilege-escalation bug rather than a known exploited threat.
A logic error in the Android kernel's ACFW FF-A (Firmware Framework for Arm A-profile) driver, implemented in acfw_ffa.c, allows a caller already holding System-level execution privileges to read memory that should remain secret, resulting in local information disclosure. Exploitation requires local access and high privileges, needs no user interaction, and affects Android devices carrying the affected kernel build per Google's Pixel security bulletin for September 2026. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 base score of 4.4 reflects limited confidentiality impact confined to already-privileged local actors.
A permission bypass in multiple Google Android system components allows an attacker who already holds System-level code execution to escalate privileges via a confused-deputy flaw. Google addressed it in the September 2026 Pixel security bulletin (patch level 2026-09-01); exploitation is local, requires no user interaction, and demands a pre-existing privileged foothold (CVSS PR:H), so it functions as a privilege-escalation link in a chain rather than a standalone remote compromise. No CISA KEV listing, no public exploit code, and no EPSS score were provided at time of analysis.
A missing bounds check in multiple locations of Android kernel code allows a local attacker who already holds System execution privileges to trigger an out-of-bounds write and escalate to higher, kernel-level privileges on affected devices. Google Android builds that ship the impacted kernel code are affected, with fixes published through the September 2026 Pixel/Android security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.7 score reflects the demanding high-privilege prerequisite rather than any remote reachability.
Local privilege escalation in Android's Bluetooth stack allows an attacker who already holds System-level execution on a device to turn a race condition in bluetooth_cco.cc into a use-after-free and elevate to a more privileged context. Google device users on builds prior to the September 2026 Pixel bulletin (patch level 2026-09-01) are the affected population, and the flaw requires no user interaction, though attack complexity is high and System privileges are a prerequisite. No public exploit code has been identified and the issue is not listed as actively exploited, so real-world risk concentrates in targeted or chained attacks against already-compromised high-value devices.
Permission bypass logic errors in Google Android allow a local actor who already holds System-level execution privileges to gain further privileges on affected devices, including Pixel handsets addressed by the September 2026 Android Security Bulletin. The flaw stems from a protection-mechanism failure in which permission checks in unspecified locations are skipped, requiring only local access and no user interaction; an attacker cannot use it for initial compromise or to escalate from an ordinary unprivileged app, since System privileges are a hard prerequisite. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment that this is a genuine but low-priority issue.
Improper input validation in the Android Cellular Modem component lets an attacker who is radio-adjacent to a device crash the modem stack, producing a denial of service against cellular voice and data with no user interaction required. The flaw carries a CVSS 3.1 base score of 5.7 (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and is classified as CWE-20; only availability is affected. Google's Pixel/Android security bulletin for September 2026 (2026-09-01) is the vendor reference, but no CISA KEV listing, no public proof-of-concept, and no EPSS data were supplied, so opportunistic mass exploitation is not indicated at time of analysis. Because exploitation is confined to the radio adjacency and the impact is availability-only, this is a moderate-priority hardening item rather than a headline emergency.
Local privilege escalation in the Android kernel affects Google Pixel devices and is addressed by the September 2026 Pixel security bulletin; an attacker who already holds System-level execution privileges on the device can exploit a logic error in the code to gain further elevated access. The flaw is a logic error rather than a memory-safety bug, requires no user interaction, and is not remotely reachable - the CVSS vector (AV:L/PR:H/UI:N) confirms it is only usable as a secondary escalation step after an initial high-privilege local compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and the EPSS score of roughly 0.12% (2nd percentile) reflects the low likelihood of exploitation, making this a low real-world priority despite the 6.7 'Medium' base score.
Out-of-bounds write in the Android kernel lets a local attacker who already holds System-level execution privileges corrupt memory and escalate to full kernel/root code execution without any user interaction. Devices running Android builds that have not yet adopted the September 2026 (2026-09-01) security patch level are affected, with Google rating the flaw High at CVSS 6.7. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with this data.
Local privilege escalation in the Android kernel stems from a use-after-free condition triggered by a race between concurrent operations, allowing an attacker who already holds System-level execution privileges on the device to elevate to a higher (kernel-level) context. The flaw carries a CVSS 3.1 base score of 6.4 (AV:L/AC:H/PR:H/UI:N) and is addressed in Google's September 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation (CISA KEV).
An out-of-bounds read in the Android kernel driver routine gf_algo_get_cached_dump_data (gf_algo.c) lets a locally positioned attacker with limited privileges read past the end of a buffer and leak kernel memory contents, with no user interaction required. Pixel builds that ship the vulnerable gf_ driver are affected, and the September 2026 Android/Pixel security bulletin provides the fix. Neither public exploit code nor a CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed and the practical threat at time of analysis is a local, post-compromise or malicious-app information leak.
Improper input validation in the MBU class handler (validate_ns_buf in mbu_class.rs) of the Android kernel allows a component already running with System execution privileges to supply a malformed namespace buffer and read kernel memory beyond the intended bounds, disclosing sensitive data. Affected are Android devices built on the impacted kernel (CPE cpe:2.3:a:google:android) as addressed by the September 2026 Android/Pixel security bulletin. The CVSS 3.1 score of 4.4 is intentionally modest because exploitation demands local code execution at a high privilege level (PR:H) with no user interaction; no public exploit code has been identified and no EPSS score was supplied with this record.
Memory corruption in the Android Trusted Execution Environment (TEE) allows a local attacker who already holds System execution privileges to escalate privileges within the secure world by supplying improperly validated input to an affected secure-world interface. The flaw is local-only (AV:L), requires high pre-existing privileges (PR:H), and needs no user interaction (UI:N), yielding high confidentiality, integrity, and availability impact if the corrupted trusted application is reached; Google rates it 6.7 (Medium). Risk is tempered by the significant foothold required, the local-only attack surface, and the low EPSS score (0.11%, 2nd percentile); no public exploit code has been identified and the flaw is not listed in CISA KEV, with fixes delivered in the Pixel security bulletin dated 2026-09-01.
Let me synthesize. CVE-2026-56923: Android kernel TIPC virtio driver (tipc_virtio_dev.c) handle_unmap_req race condition memory corruption, local EoP. CVSS 3.1: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H → 6.4. Note PR:H which is odd for a local privilege escalation "with no additional execution privileges needed" — the description says no additional execution privileges needed. Hmm, the CVSS says PR:H. There's a conflict: description says local EoP with no additional execution privileges needed (implying PR:N or PR:L?), while CVSS vector says PR:H. This is a data conflict worth noting in confidence_notes and risk_assessment. Actually Android's kernel CVEs for local EoP typically are AV:L/AC:H/PR:H/UI:N in their bulletins... Actually Android uses PR:H sometimes? Hmm. Let me note the conflict: description claims "no additional execution privileges needed" but vector shows PR:H (high privileges required), which typically means the attacker already needs elevated privileges — contradictory for an EoP. State explicitly. Product name: "Android Kernel" — 2 words. Or "TIPC Virtio Driver". Primary product per CPE: google:android. I'd say "Android Kernel". Tags: Privilege Escalation, Buffer Overflow, Google, Race Condition. Buffer Overflow mislabeled? The CWE is race condition/memory corruption. Hmm — "Buffer Overflow" tag is arguably a mislabeled tag since CWE-362 race condition and description says memory corruption not buffer overflow. But memory corruption could involve buffer overflow. I'd be moderately confident... The instructions say only emit flag when clearly wrong and verifiable. Memory corruption due to race condition — buffer overflow is a specific subclass. It's arguably mislabeling. I could flag it with low/medium confidence. Hmm. I think I'll flag it as mislabeled_tag with medium confidence since the CVE is a race condition leading to memory corruption, no buffer overflow specified. Actually careful — race conditions can cause buffer overflows (TOCTOU). Risky.
A permission bypass in Android's CPM component allows a local attacker already running code with System execution privileges to leverage a confused-deputy weakness and escalate further, gaining full read/write/execute impact on the device. Exploitation requires local access and high (System-level) privileges per the CVSS vector but no user interaction, making it a post-compromise escalation primitive rather than a remote entry point. No public exploit code or CISA KEV listing was provided in the intelligence feed, and EPSS data was absent; the fix ships through the September 2026 Android/Pixel security bulletin.
A race condition (CWE-362) in the bigo_worker_thread function of the Android kernel component bigo.c can be won by a local attacker to escalate privileges beyond their current level. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no user interaction is needed; the high attack complexity and PR:H rating reflect the need to win a TOCTOU timing window from an already-elevated context. Google disclosed and fixed the issue in the September 2026 Pixel/Android security bulletin, and there is no public exploit code or CISA KEV listing at time of analysis.
Local privilege escalation in Google Android's Video Processing Unit (VPU) component lets an attacker who already holds System-level execution privileges supply improperly validated input that overwrites shared memory, yielding high confidentiality, integrity, and availability impact with no user interaction required. The flaw (CWE-20) affects Android/Pixel builds that predate the 2026-09-01 security patch level and is only reachable locally, not over a network. Exploitation is constrained by the PR:H prerequisite - an ordinary unprivileged app cannot reach the vulnerable path - and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is correspondingly low at 0.11% (2nd percentile).
An out-of-bounds read in ReadDataElement (common.c) within the Android platform allows a locally installed application to disclose sensitive memory contents without any additional execution privileges or user interaction. The flaw is a missing/incorrect bounds check on an attacker-influenced length or index value, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N), so the practical impact is confidentiality loss rather than code execution. Affected builds are Android platform components referenced by the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is absent from the supplied data.
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
A permission bypass in Google Android stemming from a side-channel information disclosure (CWE-203) allows a local attacker holding only low-privileged code execution to escalate privileges without any user interaction. The flaw yields high confidentiality impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N) by leaking observable discrepancies that undermine permission enforcement, though the vendor vector records no integrity or availability impact. It is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis.
Memory corruption in the Android kernel's GMC mailbox message handler (gmc_mb_msg_handler in gmc_mba.c) allows a local attacker who already holds System-level execution privileges to leverage a confused-deputy condition and escalate privileges on the device. The flaw is tracked as CWE-441 and rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N), meaning it is not remotely reachable and requires a high-privilege foothold rather than being an entry point; user interaction is not needed once that footing exists. Google Devices credited the report and fixed it in the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV entry was identified at time of analysis.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
An out-of-bounds write in the Android kernel's printf implementation allows an attacker who already holds System-level privileges on the device to corrupt kernel memory and escalate further, typically to kernel/root context, by supplying improperly validated input to the affected formatting routine. Exploitation is local only and requires high privileges (CVSS 3.1 6.7, AV:L/PR:H/UI:N), so a malicious app running as System would be needed rather than a remote attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Google's September 2026 Pixel/Android security bulletin.
Local privilege escalation in the Android kernel's address remapping code (addr_remap_address_map in remap.c) allows an attacker who already holds System-level execution privileges to further elevate their access on the device. The flaw is a logic error in mapping validation that constitutes a protection-mechanism failure (CWE-693); successful exploitation requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N), with no user interaction, and yields high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS is negligible at 0.12% (2nd percentile), and fixes are bundled into Google's 2026-09-01 Android/Pixel security bulletin, making this a genuine but bounded issue rather than a top-tier emergency.
Local privilege escalation in the Android kernel lets an attacker who already holds System-level execution privileges bypass a permission check and extend that access further on affected Pixel devices covered by the September 2026 Android Security Bulletin. The flaw is a logic error in permission handling (CWE-693) that requires no user interaction but is gated behind the high precondition of pre-existing System execution context (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7), making it a privilege-boundary bypass chained after an initial compromise rather than a standalone entry point. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment of a genuinely low-priority, locally-scoped issue.
A logic error in the Android kernel's VPU (Video Processing Unit) driver can disclose kernel memory contents to code that is already running with System-level privileges. The flaw is local-only: CVSS gives AV:L with PR:H, so an attacker must first obtain elevated (System) execution on the device before triggering the information leak, and no user interaction is required once that precondition is met. There is no public exploit code and no CISA KEV listing at time of analysis, and the associated EPSS data was not supplied, so this should be treated as a post-compromise information-disclosure primitive rather than a remotely exploitable issue.
Local privilege escalation in the Android bootloader lets a caller that already holds System execution privileges bypass a missing permission check and reach higher-privileged bootloader operations on affected Android devices. The CVSS vector (AV:L/PR:H/UI:N) makes clear this is a second-stage escalation that requires both local access and an existing high-privileged foothold, not a remote or unprivileged-app vector, and it needs no user interaction. Google resolves it through the September 2026 Android/Pixel security bulletin; EPSS is very low (0.11%, 2nd percentile) and no public exploit has been identified at time of analysis.
Local privilege escalation in Google Android's image authentication service (image-auth-srv.c) allows a component that already holds System execution privileges to abuse a logic error in the gsa_sw_pk_hash_compare public-key hash-comparison routine, achieving escalation into a more trusted execution context. The flaw is reachable only locally (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), so it is not an initial-access or remote vector. Exploitability signals are weak: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the practical risk is a defense-in-depth weakness affecting Pixel/Android builds that ship the affected image authentication service.
Local privilege escalation in the Android kernel's ac_init_one_sswrp() initialization routine (init.c) allows an attacker who already holds System execution privileges on an affected Android/Pixel device to escalate further by abusing a logic error in the code, with no user interaction required. Because the assessed vector is AV:L/PR:H, this is a post-compromise escalation primitive rather than a remote or unauthenticated entry point - the pre-existing System-level foothold is the primary limiting factor, which sharply narrows realistic exploitation to attackers who have already breached a highly privileged process. No public exploit code or CISA KEV listing was identified at time of analysis, EPSS is very low (0.12%, roughly the 2nd percentile), and Google has shipped a fix in the September 2026 Pixel bulletin (2026-09-01) - consistent with a genuine but low-priority issue.
Local information disclosure in Google Android's CPM component allows a caller holding System-level execution privileges to read protected data by abusing a confused deputy (CWE-441) that performs an action on behalf of a less privileged requester without re-validating the caller's authority. Only locally positioned code already running with System privileges on an affected Android build can trigger the flaw, and no user interaction is required. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical risk is limited to post-compromise or privileged-app scenarios rather than remote attack.
Local privilege escalation in the Android Bootloader lets an attacker who already holds System-level execution privileges (PR:H) bypass a missing permission check on an exposed bootloader interface and escalate to higher integrity, confidentiality, and availability impact on the device. Exploitation is local only (AV:L), requires no user interaction (UI:N), and is confined to post-compromise escalation of a privilege boundary on affected Pixel/Android firmware, which is why the assessed severity is moderate (CVSS 6.7) despite high C/I/A ratings. EPSS is very low at 0.12% (2nd percentile), no public exploit code exists, and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; Google's September 2026 Pixel security bulletin covers the fix.
An out-of-bounds read in the AES-GCM-256 crypto implementation of the Android kernel (function do_sss_aes_gcm_256_op in crypto-aes.c) allows disclosure of memory contents to code that is already running at System privilege on an affected device. The flaw is a missing bounds check on an input length or index (CWE-120 class buffer handling error), rated 4.4 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation is local and requires the attacker to already hold System (PR:H) execution privileges; no user interaction is needed once that position is held. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the entry point sits behind a high privilege boundary the practical risk is a post-compromise or chained privilege-escalation information leak rather than an independent remote threat.
ManabiPocket for Parents 1.2.3 and earlier — an Android companion app for a Japanese parental school-communication service published by NTT Docomo Business, Inc. — exposes at least one application component that is reachable by other apps on the same device. A malicious app the user has already installed can send a crafted Intent to that component and read sensitive data held by the parental app, making this a local information-disclosure issue rather than a remote compromise. Severity is low (CVSS 4.0 base 1.8) because exploitation requires local code execution, user interaction and additional attack requirements; no public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS data was not supplied.
The YAMAP - Social Trekking GPS App for Android exposes users to information leakage and unauthorized redirects through an improperly controlled WebView (in-app browser) implementation. The vulnerability stems from insufficient access control over which URLs or communication sources the WebView will process, allowing a crafted link or external input to steer the browser toward attacker-controlled content or harvest app-internal data. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis, but user interaction is required, making social engineering the realistic attack vector.
Stored Cross-Site Scripting in the web backend of Repetico 1.9.7.31 for Android allows an authenticated remote user to inject and execute arbitrary JavaScript in other users' app contexts by embedding a malicious payload in a multiple-choice question text field. The CVSS Scope:Changed metric confirms the injected script can affect victim users beyond the attacker's own session, enabling session hijacking, credential theft, or unauthorized in-app actions. A researcher-published PoC writeup on GitHub confirms the attack path. No vendor patch or advisory has been identified at this time.
Payment bypass in the Quads Ads Manager for Google AdSense WordPress plugin (versions before 3.0.5) allows any low-privilege authenticated user capable of placing an advertising order to obtain paid ad placements at no cost. The plugin fails to verify transaction completion with the configured payment gateway before updating an order's status to paid, representing a fundamental business logic failure in the purchase flow. A publicly available proof-of-concept exploit has been published by WPScan, and the vendor has released a fix in version 3.0.5.
Multiple array index errors in programs that are automatically generated by VBox/HostServices/SharedOpenGL/crserverlib/server_dispatch.py in Oracle VirtualBox 4.2.x through 4.2.20 and 4.3.x before. Rated medium severity (CVSS 6.9). Public exploit code available and EPSS exploitation probability 12.0%.
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.1%.
Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 76.4%.
The Android API before 17 does not properly restrict the WebView.addJavascriptInterface method, which allows remote attackers to execute arbitrary methods of Java objects by using the Java Reflection. Rated medium severity (CVSS 6.8), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 76.3%.
Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the v6k and v7 ARM platforms do not validate certain addresses, which allows attackers to read or modify the. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Integer overflow in the fb_mmap function in drivers/video/fbmem.c in the Linux kernel before 3.8.9, as used in a certain Motorola build of Android 4.1.2 and other products, allows local users to. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player before 10.3.183.51 and 11.x before 11.5.502.149 on Windows and Mac OS X, before 10.3.183.51 and 11.x before 11.2.202.262 on Linux, before 11.1.111.32 on Android 2.x and 3.x, and. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.3%.
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 74.6%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.8%.
Tunnelblick 3.3beta20 and earlier relies on argv[0] to determine the name of an appropriate (1) kernel module pathname or (2) executable file pathname, which allows local users to gain privileges via. Rated high severity (CVSS 7.2), this vulnerability is low attack complexity. Public exploit code available and EPSS exploitation probability 27.8%.
Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 10.7%.
Adobe Flash Player before 10.3.183.19 and 11.x before 11.2.202.235 on Windows, Mac OS X, and Linux; before 11.1.111.9 on Android 2.x and 3.x; and before 11.1.115.8 on Android 4.x allows remote. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 90.1%.
Cross-site scripting (XSS) vulnerability in Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 16.3%.
Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Android 4.x allows. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Actively exploited in the wild (cisa kev) and public exploit code available.
Adobe Flash Player contains a type confusion vulnerability in object handling that allows remote attackers to execute arbitrary code via malicious SWF content, actively exploited in targeted attacks in April 2011.
Adobe Flash Player 10.2 and earlier across all platforms contain an unspecified vulnerability allowing remote code execution, exploited in the wild via Flash content embedded in Microsoft Office documents and web pages.
Qt6 WebEngine (qt6-qtwebengine) on Alpine Linux has been patched in package version 6.10.1-r7, addressing an unspecified vulnerability. The nature, severity, and exploitability of the underlying flaw are not disclosed in available intelligence - no CVE description, CVSS score, CWE classification, or vendor advisory narrative has been published at time of analysis. Alpine Linux is the sole reporting source, and the fix is confirmed present in the Alpine package repository at version 6.10.1-r7.
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped Wire up a gmem_invalidate_range() call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being invalidated, e.g. is being PUNCH_HOLE'd. Use the same core logic to handle invalidations as VMX does for the APIC-access page, as the two concepts are nearly identical: shove the physical address of a page into the vCPU's control structure: 1. Snapshot the invalidation sequence counter 2. Grab the pfn (from guest_memfd in this case) 3. Acquire mmu_lock for read 4. Re-request reload if retry is needed, otherwise commit the change. Note, the re-request action in #4 is necessary as KVM's retry logic is fuzzy, i.e. can get false positives. If the guest_memfd page has been dropped, at some point a subsequent reload will fail to get a PFN from guest_memfd, and KVM will fail KVM_RUN. If the retry was due to a false positive, KVM will retry until there are no relevant MMU notifier events (and will retry in the "outer" loop, i.e. will drop locks and resched as needed). Note #2! Take care to invalidate the VMSA when a relevant memslot is DELETED or MOVED, as invalidations in response to PUNCH_HOLE are predicated on memslot bindings (KVM doesn't know what GFN range(s) to invalidate without a binding). And more importantly, the VMSA mapping requires a memslot, i.e. must be invalidated if its memslots disappears, regardless of the state of the underlying guest_memfd inode. Failure to invalidate the vCPU's control.vmsa_pa (which is checked by pre_sev_run()) can prevent KVM from properly freeing the page as firmware will reject the RMPUPDATE to reclaim the page with FAIL_INUSE if the vCPU is actively running, i.e. if VMSA page is in-use. That in turn leads to an RMP #PF on the next use, as the page will still be assigned to the SNP VM. SEV-SNP: RMPUPDATE failed for PFN 78d198, pg_level: 1, ret: 3 SEV-SNP: PFN 0x78d198, RMP entry: [0xfff0000000144001 - 0x000000000000000f] CPU: 3 UID: 0 PID: 31345 Comm: sev_snp_vmsa_pu Tainted: G U O Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026 Call Trace: <TASK> dump_stack_lvl+0x54/0x70 rmpupdate+0x12c/0x140 rmp_make_shared+0x3b/0x60 sev_gmem_invalidate+0xe0/0x170 [kvm_amd] delete_from_page_cache_batch+0x1d8/0x220 truncate_inode_pages_range+0x120/0x3d0 kvm_gmem_fallocate+0x19a/0x270 [kvm] vfs_fallocate+0x1bc/0x1f0 __x64_sys_fallocate+0x48/0x70 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x496c7e </TASK> ------------[ cut here ]------------ SEV: Failed to update RMP entry for PFN 0x78d198 error -14 WARNING: arch/x86/kvm/svm/sev.c:5160 at sev_gmem_invalidate+0x126/0x170 [kvm_amd], CPU#3: sev_snp_vmsa_pu/31345 CPU: 3 UID: 0 PID: 31345 Comm: sev_snp_vmsa_pu Tainted: G U O Tainted: [U]=USER, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026 RIP: 0010:sev_gmem_invalidate+0x12b/0x170 [kvm_amd] Call Trace: <TASK> delete_from_page_cache_batch+0x1d8/0x220 truncate_inode_pages_range+0x120/0x3d0 kvm_gmem_fallocate+0x19a/0x270 [kvm] vfs_fallocate+0x1bc/0x1f0 __x64_sys_fallocate+0x48/0x70 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x496c7e </TASK> irq event stamp: 20689 hardirqs last enabled at (20699): [<ffffffff8e76092c>] __console_unlock+0x5c/0x60 hardirqs last disabled at (20708): [<ffffffff8e760911>] __console_unlock+0x41/0x60 softirqs last enabled at (20722): [<ffffffff8e6cd74e>] __irq_exit_rcu+0x7e/0x140 softirqs last disabled at (20717): [<ffffffff8e6cd74e>] __irq_exit_rcu+0x7e/0x140 ---[ end trace 0000000000000000 ]--- BUG: unable to handle page fault for address: ffff99 ---truncated---
Local attackers with authenticated access can retrieve cleartext-stored credentials from the Fermax DuoxMe Android app versions prior to 4.3.4 and impersonate the user account. This CWE-312 vulnerability requires local access to the device, and on non-rooted devices the app sandbox normally protects the data, so root or device-level access is the practical prerequisite. No public exploit code has been identified at time of analysis, and the risk is assessed as a modest-severity local issue.
Use-after-free in Chrome's Skia graphics library allows an attacker who has already compromised the renderer process to read cross-origin data after a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.47. Chromium rates the bug High severity because it can breach the same-origin boundary, even though the CVSS base score is only 3.1 (confidentiality-limited, no integrity or availability impact). No public exploit code or CISA KEV entry is associated with this CVE at time of analysis, and the attack is not automatable per CISA's SSVC assessment.
An integer overflow in Google Chrome's Compositing component (fixed in 153.0.8010.47) lets a remote attacker leak cross-origin data by getting a victim to open a crafted HTML page. Exploitation requires user interaction (the victim must load the page) but no authentication or elevated privileges, and the impact is limited to confidentiality - integrity and availability are unaffected per the CVSS vector. There is no public exploit code or CISA KEV listing at time of analysis, and the CVSS base score is only 4.3, so this is a browser-patching hygiene issue rather than an emergency incident response trigger.
Let me construct the JSON. CVE-2026-91744: Chrome on Mac, race condition in PlatformIntegration, renderer compromise + social engineering, info disclosure, CVSS 5.3, CWE-367. Let me write fields carefully. Product name: "Google Chrome" — 1-3 words. Or "Google Chrome (macOS)". Keep "Google Chrome". Summary: must not start with "A vulnerability". Start with impact verb + product. Info disclosure in Google Chrome for macOS prior to 153.0.8010.47... Race condition in PlatformIntegration component. Requires attacker to already have compromised renderer process and use social engineering (UI:R). CVSS 5.3. No KEV, no POC identified. Technical context: PlatformIntegration is macOS-specific integration layer (native macOS APIs, app bindings, drag-and-drop, services, etc.). CWE-367 TOCTOU race condition — check and use of resource with different timing, enabling a race window where a resource's state changes between check and use, allowing access to data not intended for the renderer. Chrome's multi-process architecture & site isolation — renderer compromise is assumed by Chrome's threat model. The flaw crosses the sandbox boundary in the sense that the renderer-obtained access to macOS integration surfaces yields sensitive info. Risk assessment: CVSS 5.3 moderate, AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. AC:H reflects the race condition timing win. UI:R because social engineering. PR:N per the vector — unauthenticated. Requires a compromised renderer, which raises the practical bar considerably: a separate renderer exploit is needed first. EPSS not provided — state missing. KEV not listed. No POC identified. Include "radom" once, naturally, in one sentence as illustrative hypothetical mid-sized operator. Affected products: Google Chrome on macOS prior to 153.0.8010.47. EUVD lists Chrome 153.0.8010.47 <153.0.8010.47 (odd formatting). References: chromereleases blog, chromium issue 520019273. CPE not provided — state that. Remediation: upgrade to 153.0.8010.47 or later (Ch
Confused deputy in PriceTracking in Google Chrome on on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic. (Chromium security severity: Medium)
Uninitialized memory handling in the Skia graphics library shipped with Google Chrome before 153.0.8010.47 lets a remote attacker leak cross-origin data when a victim opens a crafted HTML page. Exploitation is unauthenticated but requires the user to visit attacker-controlled content (UI:R), and impact is limited to partial confidentiality loss with no integrity or availability effect (CVSS 4.3). Google has released a stable-channel fix; no public exploit code and no CISA KEV listing were identified at time of analysis.
UI spoofing in Google Chrome's Transactions Platform component lets a remote attacker who has already compromised the browser's renderer process render crafted HTML as trusted interface elements, deceiving the user. The flaw is a missing authorization check (CWE-862) affecting Chrome versions prior to 153.0.8010.47, and it is not reachable on its own: exploitation requires a separate, earlier renderer compromise plus the victim loading and interacting with the attacker's page (UI:R, AC:H). Impact is limited to low-severity confidentiality and availability effects rather than code execution or sandbox escape, no public exploit code was identified at time of analysis, and the issue is fully resolved by Chrome 153.0.8010.47.
Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
Cross-origin data disclosure in Google Chrome versions prior to 153.0.8010.47 occurs when an attacker who has already compromised the renderer process lures a victim to a crafted HTML page. The weakness lives in the GetUserMedia media-capture code path, where incomplete cleanup (CWE-459) leaves cross-origin data recoverable, as captured by the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N (score 3.1) - unauthenticated network reach but high attack complexity, mandatory user interaction, and confidentiality-only, low-magnitude impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped the fix in Chrome 153.0.8010.47.
Google Chrome for Android versions prior to 153.0.8010.47 contain an out-of-bounds read in the WebGL rendering path that allows a remote attacker to leak memory from outside the browser sandbox by luring a victim into opening a crafted HTML page. Google labels the Chromium security severity as Critical, while the published CVSS 3.1 base score is a comparatively modest 4.7 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) because the flaw yields a limited confidentiality leak rather than code execution or data modification. A vendor patch is available, and no public exploit code or CISA KEV entry was identified at the time of analysis.
Information disclosure in Google Chrome desktop builds prior to 153.0.8010.47 allows a remote attacker to leak sensitive data by measuring observable CSS rendering discrepancies induced by a crafted HTML page. Exploitation is unauthenticated (PR:N) but requires the victim to open the attacker-controlled page (UI:R), and the leak depends on high-attack-complexity side-channel measurement rather than a deterministic parsing bug, so the impact is limited to confidentiality with no integrity or availability effect. The issue is rated Medium by Chromium; no public exploit code has been identified at time of analysis, and Google has released a fixed build.
Race condition in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
An uninitialized-resource flaw (CWE-908) in ANGLE, the graphics translation layer used by Chrome to render WebGL and accelerated 2D content, is present in Google Chrome builds prior to 153.0.8010.47. A remote attacker who convinces a user to open a crafted HTML page can cause ANGLE to return memory contents that were never initialized, disclosing data that is outside Chrome's sandbox boundary — an information-disclosure primitive rather than a code-execution bug. Google rates the issue High severity (Chromium) and has published a fixed build; the NVD CVSS score is 4.7 and there is no CISA KEV entry or identified public exploit code at time of analysis.
Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)
Information disclosure in Google Chrome for Android before 153.0.8010.47 allows a locally installed app on the same device to retrieve sensitive browser data because an authorization check is missing on an Android-exposed Chrome component. The flaw is local-only and rated AC:H, giving a modest CVSS 3.1 base of 5.1 (AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) even though the confidentiality impact is complete; Google's Chromium team nevertheless classifies it as High severity. Google has shipped a fix in 153.0.8010.47, there is no CISA KEV listing, and no public exploit code has been identified at time of analysis.
Information disclosure in Google Chrome builds prior to 153.0.8010.47 allows a remote, unauthenticated attacker to leak sensitive data from the victim's browser by measuring font-related observable discrepancies on a crafted HTML page, a technique that requires the victim to be socially engineered into loading that page (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.3). Impact is confidentiality-only, with no integrity or availability effect, and the high attack complexity reflects the probabilistic nature of the CWE-203 side channel, so reliable exfiltration demands specific conditions rather than a single deterministic request. No public exploit code was identified at time of analysis and the flaw is not listed in CISA KEV; Google has shipped a vendor-released patch in Chrome 153.0.8010.47, and auto-updating installations at or above that version are not affected.
UI spoofing in Google Chrome versions prior to 153.0.8010.47 allows an attacker who has already compromised the browser's renderer process to draw convincing but fake interface elements in front of the user via a crafted HTML page. The flaw is a missing authorization check (CWE-862) on a browser-side privileged capability, rated Medium by the Chromium team and scored 4.2 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L), with impact limited to Low confidentiality and Low availability and no integrity effect. Exploitation is not possible as a standalone initial-access vector - renderer compromise is a mandatory precondition, user interaction is required, and attack complexity is High; no CISA KEV listing and no public exploit code were identified at time of analysis. A vendor-released patch exists in Chrome 153.0.8010.47.
Cross-origin data disclosure in Google Chrome prior to 153.0.8010.47: a race condition (TOCTOU) in the browser's Network component lets a remote attacker who has already achieved code execution inside the renderer process read data belonging to other origins by luring a victim to a crafted HTML page. The impact is limited to confidentiality of cross-origin responses (C:L, I:N, A:N), and exploitation is rated High complexity with required user interaction; no public exploit code or CISA KEV entry was present in the supplied intelligence, and the vendor has shipped a fix in 153.0.8010.47.
An out-of-bounds write in the Android kernel GNSS link driver lets a local process that already holds System execution privileges corrupt kernel memory and escalate to kernel-level code execution. The defect (CWE-787) is a missing bounds check in link_load_gnss_image() in link_device.c, requires no user interaction, and is addressed through Google's September 2026 Android/Pixel security bulletin. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Local privilege escalation in the arm-smmu-v3 driver of Google's Android kernel lets code already running with System privileges bypass the ARM SMMUv3 protection mechanism and reach higher-level (kernel/root) execution on affected ARM-based devices, including Pixel. The root cause is a logic error classified as CWE-693 (Protection Mechanism Failure), reachable without any user interaction but only from a local, already-privileged context (CVSS PR:H). No public exploit code and no active exploitation have been identified at time of analysis, so this is a monthly-bulletin hardening fix rather than an emergency patch.
Local privilege escalation in Google Android's GPU driver component allows a process that already runs with System execution privileges to bypass a permission check through a logic error, gaining full read/write/execute impact at a higher privilege level. Only Android devices carrying the affected GPU component are exposed, and exploitation is strictly local with no user interaction, so it cannot be triggered by a remote attacker or a normal unprivileged app on its own. There is no public exploit code and no CISA KEV listing identified at time of analysis; remediation is delivered through the September 2026 Android/Pixel security bulletin.
Local privilege escalation in the Android kernel's arm-smmu-v3 driver (smmu_install_nested_ste) lets a process that already runs with System execution privileges turn a logic error in SMMU stream-table-entry handling into full kernel-level compromise of confidentiality, integrity, and availability. Only devices whose kernel exposes the ARM SMMUv3 driver in a nested-translation configuration are affected, and Google rates it Moderate with a CVSS base of 6.7 (AV:L/PR:H), meaning exploitation presupposes a highly privileged local foothold rather than remote or unauthenticated access. There is no indication of public exploit code and the issue is not listed in CISA KEV; Google's Pixel bulletin of 2026-09-01 ships the fix.
A use-after-free in the ARM SMMU v3 driver (arm-smmu-v3.c) of the Android kernel lets a local attacker who already holds System-level execution privileges corrupt kernel memory and escalate to full kernel/System privilege. The flaw is a logic error in one of several driver functions that leaves a freed object reachable, and no user interaction is needed once the attacker has code running at that privilege level. It is ranked CVSS 6.7 (AV:L/PR:H), there is no indication of active exploitation or public exploit code, and Google published a fix in the September 2026 Pixel security bulletin.
A logic error in the ARM SMMU v3 driver's smmu_detach_dev path allows a caller who already holds System-level privileges on an Android device to bypass SMMU/IOMU memory-permission checks and escalate to kernel (EL1) execution, achieving full compromise of the device. Affected are Google Pixel/Android builds using the arm-smmu-v3 driver prior to the September 2026 Android Security Bulletin patch level. Exploitation is local, requires no user interaction, and no public exploit code or CISA KEV listing was identified at time of analysis, so the practical risk is concentrated on devices that already run privileged or partially compromised code.
A confused-deputy flaw (CWE-441) in the Android platform's message-handler initialization routine, platform_msg_handler_init in default_msg_handlers.c, lets a local process that already runs with System privileges have privileged operations performed on its behalf by a more trusted component, resulting in local privilege escalation with high impact to confidentiality, integrity and availability. Exploitation requires local execution at the System privilege level (CVSS PR:H) and no user interaction, so it is not reachable by an ordinary unprivileged app. There is no public exploit code identified and the issue is not in CISA KEV; it was published through the September 2026 Android/Pixel security bulletin, so risk to most users is conditional on already having a System-level foothold or being part of an exploit chain.
An out-of-bounds read in the Pixel-specific physmem_extmem driver (physmem_extmem_linux.c) of the Android kernel lets a local process with low privileges read kernel memory that was never initialized, exposing potentially sensitive data. No user interaction or elevated execution privileges are required, and the impact is limited to confidentiality (CVSS 5.5, AV:L/PR:L/C:H). The issue is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified at the time of analysis.
A missing permission check in the FSM key-release routine (FsmReleaseKey in fsm.c) of the Android kernel allows a locally positioned attacker to bypass an access-control verification and escalate privileges on affected devices. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is classified as CWE-693, Protection Mechanism Failure, because the intended permission gate is simply not enforced on that code path. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no public exploit code or CISA KEV entry has been identified at time of analysis.
Uninitialized memory use in multiple locations of the Android kernel allows a locally-positioned attacker who already holds System-level execution privileges to read stale kernel memory contents, resulting in information disclosure. The flaw is rated CVSS 4.4 (AV:L/PR:H) and affects Android builds covered by the September 2026 Pixel/Android Security Bulletin; user interaction is not required. No public exploit code and no CISA KEV listing were identified at time of analysis, and the exploitation prerequisite of pre-existing System privileges keeps the practical risk confined to post-compromise or privileged-local scenarios.
Local escalation of privilege in the Android kernel's ARM SMMU v3 driver lets a process that already runs with System privileges reach kernel-level code execution by passing malformed input to the nested device-detach path (smmu_detach_dev_nested in arm-smmu-v3.c). Because the CVSS vector requires PR:H, this is not a boundary an ordinary unprivileged app can cross — it is a second-stage escalation for code that already holds highly privileged, kernel-adjacent access on the device. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, so risk is driven by the monthly Android/Pixel kernel patch cycle rather than by observed attacks; no EPSS score was supplied in the input data.
A time-of-check to time-of-use (TOCTOU) race condition in multiple locations of the Android kernel allows an attacker who already holds System-level execution privileges on a device to win a timing window and escalate to higher (kernel/root) privileges, with no user interaction required. The flaw is rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N) and is fixed through the September 2026 Android Security Bulletin for Pixel devices. At the time of analysis there is no CISA KEV listing and no public exploit code identified, and no EPSS score was supplied, so the practical risk is concentrated in post-compromise privilege escalation rather than remote mass exploitation.
Local privilege escalation in the Android kernel's PMIC inter-process-communication driver (ap_pmic_ipc.c) lets a caller that already holds System execution privileges bypass permission checks via a confused-deputy flaw in ap_pmic_poll_msg_handler and gain kernel-level code execution. Only Android devices that carry the affected PMIC IPC driver — the Google Pixel bulletin of 2026-09-01 is the vendor reference, and the CPE scopes this to google:android — are exposed, and the attacker must already be running with elevated (System) privileges on the device. No public exploit code or CISA KEV entry was identified at time of analysis, and no EPSS score was supplied, so this reads as a post-compromise escalation primitive rather than a remotely reachable entry point.
Local privilege escalation in Google Android/Pixel arises from a permission bypass in the DreamPickerReceiver.kt component (the Daydream/screensaver picker), where a confused-deputy flaw lets a locally installed application reach privileged operations that execute with System privileges. Affected are Android/Pixel builds at security patch levels prior to the 2026-09-01 bulletin; exploitation requires the attacker to already have local code execution via a malicious or compromised app, and no user interaction is needed once that app is present. The issue is fully local (AV:L) with no remote or network reach, no public exploit code has been identified at time of analysis, and devices carrying the 2026-09-01 patch level are not exposed.
An out-of-bounds write in the Android kernel, caused by a missing bounds check, allows an attacker who already holds System-level execution privileges on a device to corrupt kernel memory and escalate to full kernel/root privileges. The flaw is reachable only with local access (AV:L, PR:H) and requires no user interaction, and the associated CVSS score of 6.7 reflects high integrity, confidentiality and availability impact rather than ease of reach. No public exploit code or CISA KEV active-exploitation listing was provided in the available intelligence, so this is currently assessed as a patch-priority local privilege-escalation bug rather than a known exploited threat.
A logic error in the Android kernel's ACFW FF-A (Firmware Framework for Arm A-profile) driver, implemented in acfw_ffa.c, allows a caller already holding System-level execution privileges to read memory that should remain secret, resulting in local information disclosure. Exploitation requires local access and high privileges, needs no user interaction, and affects Android devices carrying the affected kernel build per Google's Pixel security bulletin for September 2026. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 3.1 base score of 4.4 reflects limited confidentiality impact confined to already-privileged local actors.
A permission bypass in multiple Google Android system components allows an attacker who already holds System-level code execution to escalate privileges via a confused-deputy flaw. Google addressed it in the September 2026 Pixel security bulletin (patch level 2026-09-01); exploitation is local, requires no user interaction, and demands a pre-existing privileged foothold (CVSS PR:H), so it functions as a privilege-escalation link in a chain rather than a standalone remote compromise. No CISA KEV listing, no public exploit code, and no EPSS score were provided at time of analysis.
A missing bounds check in multiple locations of Android kernel code allows a local attacker who already holds System execution privileges to trigger an out-of-bounds write and escalate to higher, kernel-level privileges on affected devices. Google Android builds that ship the impacted kernel code are affected, with fixes published through the September 2026 Pixel/Android security bulletin. No public exploit code or active exploitation has been identified at time of analysis, and the CVSS 6.7 score reflects the demanding high-privilege prerequisite rather than any remote reachability.
Local privilege escalation in Android's Bluetooth stack allows an attacker who already holds System-level execution on a device to turn a race condition in bluetooth_cco.cc into a use-after-free and elevate to a more privileged context. Google device users on builds prior to the September 2026 Pixel bulletin (patch level 2026-09-01) are the affected population, and the flaw requires no user interaction, though attack complexity is high and System privileges are a prerequisite. No public exploit code has been identified and the issue is not listed as actively exploited, so real-world risk concentrates in targeted or chained attacks against already-compromised high-value devices.
Permission bypass logic errors in Google Android allow a local actor who already holds System-level execution privileges to gain further privileges on affected devices, including Pixel handsets addressed by the September 2026 Android Security Bulletin. The flaw stems from a protection-mechanism failure in which permission checks in unspecified locations are skipped, requiring only local access and no user interaction; an attacker cannot use it for initial compromise or to escalate from an ordinary unprivileged app, since System privileges are a hard prerequisite. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment that this is a genuine but low-priority issue.
Improper input validation in the Android Cellular Modem component lets an attacker who is radio-adjacent to a device crash the modem stack, producing a denial of service against cellular voice and data with no user interaction required. The flaw carries a CVSS 3.1 base score of 5.7 (AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) and is classified as CWE-20; only availability is affected. Google's Pixel/Android security bulletin for September 2026 (2026-09-01) is the vendor reference, but no CISA KEV listing, no public proof-of-concept, and no EPSS data were supplied, so opportunistic mass exploitation is not indicated at time of analysis. Because exploitation is confined to the radio adjacency and the impact is availability-only, this is a moderate-priority hardening item rather than a headline emergency.
Local privilege escalation in the Android kernel affects Google Pixel devices and is addressed by the September 2026 Pixel security bulletin; an attacker who already holds System-level execution privileges on the device can exploit a logic error in the code to gain further elevated access. The flaw is a logic error rather than a memory-safety bug, requires no user interaction, and is not remotely reachable - the CVSS vector (AV:L/PR:H/UI:N) confirms it is only usable as a secondary escalation step after an initial high-privilege local compromise. There is no public exploit identified at time of analysis, no CISA KEV listing, and the EPSS score of roughly 0.12% (2nd percentile) reflects the low likelihood of exploitation, making this a low real-world priority despite the 6.7 'Medium' base score.
Out-of-bounds write in the Android kernel lets a local attacker who already holds System-level execution privileges corrupt memory and escalate to full kernel/root code execution without any user interaction. Devices running Android builds that have not yet adopted the September 2026 (2026-09-01) security patch level are affected, with Google rating the flaw High at CVSS 6.7. No public exploit code and no CISA KEV entry were identified at time of analysis, and no EPSS score was supplied with this data.
Local privilege escalation in the Android kernel stems from a use-after-free condition triggered by a race between concurrent operations, allowing an attacker who already holds System-level execution privileges on the device to elevate to a higher (kernel-level) context. The flaw carries a CVSS 3.1 base score of 6.4 (AV:L/AC:H/PR:H/UI:N) and is addressed in Google's September 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis and no indication of confirmed active exploitation (CISA KEV).
An out-of-bounds read in the Android kernel driver routine gf_algo_get_cached_dump_data (gf_algo.c) lets a locally positioned attacker with limited privileges read past the end of a buffer and leak kernel memory contents, with no user interaction required. Pixel builds that ship the vulnerable gf_ driver are affected, and the September 2026 Android/Pixel security bulletin provides the fix. Neither public exploit code nor a CISA KEV entry was present in the supplied intelligence, and no EPSS score was provided, so active exploitation is unconfirmed and the practical threat at time of analysis is a local, post-compromise or malicious-app information leak.
Improper input validation in the MBU class handler (validate_ns_buf in mbu_class.rs) of the Android kernel allows a component already running with System execution privileges to supply a malformed namespace buffer and read kernel memory beyond the intended bounds, disclosing sensitive data. Affected are Android devices built on the impacted kernel (CPE cpe:2.3:a:google:android) as addressed by the September 2026 Android/Pixel security bulletin. The CVSS 3.1 score of 4.4 is intentionally modest because exploitation demands local code execution at a high privilege level (PR:H) with no user interaction; no public exploit code has been identified and no EPSS score was supplied with this record.
Memory corruption in the Android Trusted Execution Environment (TEE) allows a local attacker who already holds System execution privileges to escalate privileges within the secure world by supplying improperly validated input to an affected secure-world interface. The flaw is local-only (AV:L), requires high pre-existing privileges (PR:H), and needs no user interaction (UI:N), yielding high confidentiality, integrity, and availability impact if the corrupted trusted application is reached; Google rates it 6.7 (Medium). Risk is tempered by the significant foothold required, the local-only attack surface, and the low EPSS score (0.11%, 2nd percentile); no public exploit code has been identified and the flaw is not listed in CISA KEV, with fixes delivered in the Pixel security bulletin dated 2026-09-01.
Let me synthesize. CVE-2026-56923: Android kernel TIPC virtio driver (tipc_virtio_dev.c) handle_unmap_req race condition memory corruption, local EoP. CVSS 3.1: AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H → 6.4. Note PR:H which is odd for a local privilege escalation "with no additional execution privileges needed" — the description says no additional execution privileges needed. Hmm, the CVSS says PR:H. There's a conflict: description says local EoP with no additional execution privileges needed (implying PR:N or PR:L?), while CVSS vector says PR:H. This is a data conflict worth noting in confidence_notes and risk_assessment. Actually Android's kernel CVEs for local EoP typically are AV:L/AC:H/PR:H/UI:N in their bulletins... Actually Android uses PR:H sometimes? Hmm. Let me note the conflict: description claims "no additional execution privileges needed" but vector shows PR:H (high privileges required), which typically means the attacker already needs elevated privileges — contradictory for an EoP. State explicitly. Product name: "Android Kernel" — 2 words. Or "TIPC Virtio Driver". Primary product per CPE: google:android. I'd say "Android Kernel". Tags: Privilege Escalation, Buffer Overflow, Google, Race Condition. Buffer Overflow mislabeled? The CWE is race condition/memory corruption. Hmm — "Buffer Overflow" tag is arguably a mislabeled tag since CWE-362 race condition and description says memory corruption not buffer overflow. But memory corruption could involve buffer overflow. I'd be moderately confident... The instructions say only emit flag when clearly wrong and verifiable. Memory corruption due to race condition — buffer overflow is a specific subclass. It's arguably mislabeling. I could flag it with low/medium confidence. Hmm. I think I'll flag it as mislabeled_tag with medium confidence since the CVE is a race condition leading to memory corruption, no buffer overflow specified. Actually careful — race conditions can cause buffer overflows (TOCTOU). Risky.
A permission bypass in Android's CPM component allows a local attacker already running code with System execution privileges to leverage a confused-deputy weakness and escalate further, gaining full read/write/execute impact on the device. Exploitation requires local access and high (System-level) privileges per the CVSS vector but no user interaction, making it a post-compromise escalation primitive rather than a remote entry point. No public exploit code or CISA KEV listing was provided in the intelligence feed, and EPSS data was absent; the fix ships through the September 2026 Android/Pixel security bulletin.
A race condition (CWE-362) in the bigo_worker_thread function of the Android kernel component bigo.c can be won by a local attacker to escalate privileges beyond their current level. Exploitation requires the attacker to already hold System-level execution privileges on the device, and no user interaction is needed; the high attack complexity and PR:H rating reflect the need to win a TOCTOU timing window from an already-elevated context. Google disclosed and fixed the issue in the September 2026 Pixel/Android security bulletin, and there is no public exploit code or CISA KEV listing at time of analysis.
Local privilege escalation in Google Android's Video Processing Unit (VPU) component lets an attacker who already holds System-level execution privileges supply improperly validated input that overwrites shared memory, yielding high confidentiality, integrity, and availability impact with no user interaction required. The flaw (CWE-20) affects Android/Pixel builds that predate the 2026-09-01 security patch level and is only reachable locally, not over a network. Exploitation is constrained by the PR:H prerequisite - an ordinary unprivileged app cannot reach the vulnerable path - and no public exploit code or confirmed active exploitation has been identified at time of analysis; EPSS is correspondingly low at 0.11% (2nd percentile).
An out-of-bounds read in ReadDataElement (common.c) within the Android platform allows a locally installed application to disclose sensitive memory contents without any additional execution privileges or user interaction. The flaw is a missing/incorrect bounds check on an attacker-influenced length or index value, rated CVSS 5.5 (AV:L/AC:L/PR:L/UI:N, C:H/I:N/A:N), so the practical impact is confidentiality loss rather than code execution. Affected builds are Android platform components referenced by the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV listing was identified at time of analysis, and the EPSS signal is absent from the supplied data.
Permission bypass in the Android kernel, caused by an integer overflow in multiple code locations, allows an actor who already holds Android System execution privileges on a Pixel device to escalate privileges locally with no user interaction required. The vendor scores it 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H), and the PR:H prerequisite is the decisive constraint: the high confidentiality, integrity and availability metrics describe what a System-context actor can reach, not what an ordinary installed app or remote attacker can achieve. EPSS is 0.12% (2nd percentile) and there is no public exploit code or CISA KEV entry identified at time of analysis, so the defect functions as a secondary privilege-boundary escape usable only after an initial System-level compromise, not as a standalone entry point.
A permission bypass in Google Android stemming from a side-channel information disclosure (CWE-203) allows a local attacker holding only low-privileged code execution to escalate privileges without any user interaction. The flaw yields high confidentiality impact (CVSS 5.5, AV:L/AC:L/PR:L/UI:N) by leaking observable discrepancies that undermine permission enforcement, though the vendor vector records no integrity or availability impact. It is addressed in the September 2026 Android/Pixel security bulletin; no public exploit code or CISA KEV listing was identified in the supplied intelligence at time of analysis.
Memory corruption in the Android kernel's GMC mailbox message handler (gmc_mb_msg_handler in gmc_mba.c) allows a local attacker who already holds System-level execution privileges to leverage a confused-deputy condition and escalate privileges on the device. The flaw is tracked as CWE-441 and rated CVSS 6.7 (AV:L/AC:L/PR:H/UI:N), meaning it is not remotely reachable and requires a high-privilege foothold rather than being an entry point; user interaction is not needed once that footing exists. Google Devices credited the report and fixed it in the September 2026 Pixel/Android security bulletin; no public exploit code or CISA KEV entry was identified at time of analysis.
An out-of-bounds write in the Android kernel's remap.c code allows a local attacker holding System-level execution privileges to corrupt kernel memory and escalate to full kernel (root) privileges. The flaw stems from an incorrect bounds check (CWE-787) that fails to validate an offset or length before a write, and no user interaction is required once the attacker has the prerequisite System privileges. At the time of analysis there is no public exploit code and the issue is not listed in CISA KEV, but the September 2026 Pixel security bulletin confirms a vendor fix is available.
Local privilege escalation in the Google Android kernel stems from an out-of-bounds write caused by improper input validation in multiple code locations. An attacker who already holds System-level execution privileges on the device can craft malformed input to corrupt memory and elevate to kernel privileges on affected Android builds. No user interaction is required, and no public exploit code or CISA KEV entry was identified at time of analysis, though the vendor-published September 2026 Pixel bulletin confirms a fix is available.
An out-of-bounds write in the Android kernel's printf implementation allows an attacker who already holds System-level privileges on the device to corrupt kernel memory and escalate further, typically to kernel/root context, by supplying improperly validated input to the affected formatting routine. Exploitation is local only and requires high privileges (CVSS 3.1 6.7, AV:L/PR:H/UI:N), so a malicious app running as System would be needed rather than a remote attacker. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is fixed in Google's September 2026 Pixel/Android security bulletin.
Local privilege escalation in the Android kernel's address remapping code (addr_remap_address_map in remap.c) allows an attacker who already holds System-level execution privileges to further elevate their access on the device. The flaw is a logic error in mapping validation that constitutes a protection-mechanism failure (CWE-693); successful exploitation requires local access and high privileges (CVSS:3.1/AV:L/AC:L/PR:H/UI:N), with no user interaction, and yields high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and no confirmed actively exploited (CISA KEV) status; EPSS is negligible at 0.12% (2nd percentile), and fixes are bundled into Google's 2026-09-01 Android/Pixel security bulletin, making this a genuine but bounded issue rather than a top-tier emergency.
Local privilege escalation in the Android kernel lets an attacker who already holds System-level execution privileges bypass a permission check and extend that access further on affected Pixel devices covered by the September 2026 Android Security Bulletin. The flaw is a logic error in permission handling (CWE-693) that requires no user interaction but is gated behind the high precondition of pre-existing System execution context (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, base 6.7), making it a privilege-boundary bypass chained after an initial compromise rather than a standalone entry point. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.13% (3rd percentile), consistent with an assessment of a genuinely low-priority, locally-scoped issue.
A logic error in the Android kernel's VPU (Video Processing Unit) driver can disclose kernel memory contents to code that is already running with System-level privileges. The flaw is local-only: CVSS gives AV:L with PR:H, so an attacker must first obtain elevated (System) execution on the device before triggering the information leak, and no user interaction is required once that precondition is met. There is no public exploit code and no CISA KEV listing at time of analysis, and the associated EPSS data was not supplied, so this should be treated as a post-compromise information-disclosure primitive rather than a remotely exploitable issue.
Local privilege escalation in the Android bootloader lets a caller that already holds System execution privileges bypass a missing permission check and reach higher-privileged bootloader operations on affected Android devices. The CVSS vector (AV:L/PR:H/UI:N) makes clear this is a second-stage escalation that requires both local access and an existing high-privileged foothold, not a remote or unprivileged-app vector, and it needs no user interaction. Google resolves it through the September 2026 Android/Pixel security bulletin; EPSS is very low (0.11%, 2nd percentile) and no public exploit has been identified at time of analysis.
Local privilege escalation in Google Android's image authentication service (image-auth-srv.c) allows a component that already holds System execution privileges to abuse a logic error in the gsa_sw_pk_hash_compare public-key hash-comparison routine, achieving escalation into a more trusted execution context. The flaw is reachable only locally (AV:L) and requires high privileges (PR:H) with no user interaction (UI:N), so it is not an initial-access or remote vector. Exploitability signals are weak: EPSS is 0.12% (2nd percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis; the practical risk is a defense-in-depth weakness affecting Pixel/Android builds that ship the affected image authentication service.
Local privilege escalation in the Android kernel's ac_init_one_sswrp() initialization routine (init.c) allows an attacker who already holds System execution privileges on an affected Android/Pixel device to escalate further by abusing a logic error in the code, with no user interaction required. Because the assessed vector is AV:L/PR:H, this is a post-compromise escalation primitive rather than a remote or unauthenticated entry point - the pre-existing System-level foothold is the primary limiting factor, which sharply narrows realistic exploitation to attackers who have already breached a highly privileged process. No public exploit code or CISA KEV listing was identified at time of analysis, EPSS is very low (0.12%, roughly the 2nd percentile), and Google has shipped a fix in the September 2026 Pixel bulletin (2026-09-01) - consistent with a genuine but low-priority issue.
Local information disclosure in Google Android's CPM component allows a caller holding System-level execution privileges to read protected data by abusing a confused deputy (CWE-441) that performs an action on behalf of a less privileged requester without re-validating the caller's authority. Only locally positioned code already running with System privileges on an affected Android build can trigger the flaw, and no user interaction is required. There is no CISA KEV listing and no public exploit code identified at time of analysis, so the practical risk is limited to post-compromise or privileged-app scenarios rather than remote attack.
Local privilege escalation in the Android Bootloader lets an attacker who already holds System-level execution privileges (PR:H) bypass a missing permission check on an exposed bootloader interface and escalate to higher integrity, confidentiality, and availability impact on the device. Exploitation is local only (AV:L), requires no user interaction (UI:N), and is confined to post-compromise escalation of a privilege boundary on affected Pixel/Android firmware, which is why the assessed severity is moderate (CVSS 6.7) despite high C/I/A ratings. EPSS is very low at 0.12% (2nd percentile), no public exploit code exists, and there is no confirmed active exploitation (not in CISA KEV) at time of analysis; Google's September 2026 Pixel security bulletin covers the fix.
An out-of-bounds read in the AES-GCM-256 crypto implementation of the Android kernel (function do_sss_aes_gcm_256_op in crypto-aes.c) allows disclosure of memory contents to code that is already running at System privilege on an affected device. The flaw is a missing bounds check on an input length or index (CWE-120 class buffer handling error), rated 4.4 (Medium) with the vector CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, meaning exploitation is local and requires the attacker to already hold System (PR:H) execution privileges; no user interaction is needed once that position is held. There is no indication of confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, and because the entry point sits behind a high privilege boundary the practical risk is a post-compromise or chained privilege-escalation information leak rather than an independent remote threat.
ManabiPocket for Parents 1.2.3 and earlier — an Android companion app for a Japanese parental school-communication service published by NTT Docomo Business, Inc. — exposes at least one application component that is reachable by other apps on the same device. A malicious app the user has already installed can send a crafted Intent to that component and read sensitive data held by the parental app, making this a local information-disclosure issue rather than a remote compromise. Severity is low (CVSS 4.0 base 1.8) because exploitation requires local code execution, user interaction and additional attack requirements; no public exploit code and no CISA KEV entry were identified at time of analysis, and EPSS data was not supplied.
The YAMAP - Social Trekking GPS App for Android exposes users to information leakage and unauthorized redirects through an improperly controlled WebView (in-app browser) implementation. The vulnerability stems from insufficient access control over which URLs or communication sources the WebView will process, allowing a crafted link or external input to steer the browser toward attacker-controlled content or harvest app-internal data. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at the time of analysis, but user interaction is required, making social engineering the realistic attack vector.
Stored Cross-Site Scripting in the web backend of Repetico 1.9.7.31 for Android allows an authenticated remote user to inject and execute arbitrary JavaScript in other users' app contexts by embedding a malicious payload in a multiple-choice question text field. The CVSS Scope:Changed metric confirms the injected script can affect victim users beyond the attacker's own session, enabling session hijacking, credential theft, or unauthorized in-app actions. A researcher-published PoC writeup on GitHub confirms the attack path. No vendor patch or advisory has been identified at this time.
Payment bypass in the Quads Ads Manager for Google AdSense WordPress plugin (versions before 3.0.5) allows any low-privilege authenticated user capable of placing an advertising order to obtain paid ad placements at no cost. The plugin fails to verify transaction completion with the configured payment gateway before updating an order's status to paid, representing a fundamental business logic failure in the purchase flow. A publicly available proof-of-concept exploit has been published by WPScan, and the vendor has released a fix in version 3.0.5.