Page 26 of 100 — Google CVEs from a corpus of 15879, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-48631 | Medium | 6.5 | 2025-12-08 | In onHeaderDecoded of LocalImageResolver.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to remote denial of… |
CVE-2025-48629 | High | 7.8 | 2025-12-08 | In findAvailRecognizer of VoiceInteractionManagerService.java, there is a possible way to become the default speech recognizer app due to an insecure default v… |
CVE-2025-48628 | High | 7.8 | 2025-12-08 | In validateIconUserBoundary of PrintManagerService.java, there is a possible cross-user image leak due to a confused deputy. This could lead to local escalatio… |
CVE-2025-48627 | High | 7.8 | 2025-12-08 | In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to launch an activity from the background due to a logic error in the… |
CVE-2025-48626 | Critical | 9.8 | 2025-12-08 | In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure. This could lead to remote esca… |
CVE-2025-48624 | High | 7.8 | 2025-12-08 | In multiple functions of arm-smmu-v3.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local escalation of privil… |
CVE-2025-48623 | High | 7.8 | 2025-12-08 | In init_pkvm_hyp_vcpu of pkvm.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege wit… |
CVE-2025-48622 | Medium | 5.5 | 2025-12-08 | In ProcessArea of dng_misc_opcodes.cpp, there is a possible out of bounds read due to a buffer overflow. This could lead to local information disclosure with n… |
CVE-2025-48621 | High | 7.3 | 2025-12-08 | In DefaultTransitionHandler.java, there is a possible way to enable a tapjacking attack due to a insecure default. This could lead to local escalation of privi… |
CVE-2025-48620 | High | 7.8 | 2025-12-08 | In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after u… |
CVE-2025-48618 | Medium | 6.8 | 2025-12-08 | In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to p… |
CVE-2025-48615 | High | 7.8 | 2025-12-08 | In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalatio… |
CVE-2025-48614 | Medium | 4.6 | 2025-12-08 | In rebootWipeUserData of RecoverySystem.java, there is a possible way to factory reset the device while in DSU mode due to a missing permission check. This cou… |
CVE-2025-48612 | High | 7.8 | 2025-12-08 | In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper… |
CVE-2025-48610 | Medium | 5.5 | 2025-12-08 | In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code. This could lead to local inf… |
CVE-2025-48607 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code. This could lead to local denial of service… |
CVE-2025-48604 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosu… |
CVE-2025-48603 | Medium | 5.5 | 2025-12-08 | In InputMethodInfo of InputMethodInfo.java, there is a possible permanent denial of service due to resource exhaustion. This could lead to local denial of serv… |
CVE-2025-48601 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible permanent denial of service due to improper input validation. This could lead to local escalation of privilege with… |
CVE-2025-48600 | Medium | 5.5 | 2025-12-08 | In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosur… |
CVE-2025-48599 | High | 7.8 | 2025-12-08 | In multiple functions of WifiScanModeActivity.java, there is a possible way to bypass a device config restriction due to a missing permission check. This could… |
CVE-2025-48598 | Medium | 6.6 | 2025-12-08 | In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy. This could lead to physical escalatio… |
CVE-2025-48597 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalat… |
CVE-2025-48596 | High | 7.8 | 2025-12-08 | In appendFrom of Parcel.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with no add… |
CVE-2025-48594 | High | 7.3 | 2025-12-08 | In onUidImportance of DisassociationProcessor.java, there is a possible way to retain companion application privileges after disassociation due to improper inp… |
CVE-2025-48592 | High | 7.5 | 2025-12-08 | In initDecoder of C2SoftDav1dDec.cpp, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote information disclosure wi… |
CVE-2025-48591 | Medium | 5.5 | 2025-12-08 | In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information disclosu… |
CVE-2025-48590 | Medium | 5.5 | 2025-12-08 | In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances d… |
CVE-2025-48589 | High | 7.8 | 2025-12-08 | In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code. This coul… |
CVE-2025-48588 | High | 7.8 | 2025-12-08 | In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code. This could lead to local escalation of priv… |
CVE-2025-48586 | High | 7.8 | 2025-12-08 | In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to l… |
CVE-2025-48584 | Medium | 5.5 | 2025-12-08 | In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion. This co… |
CVE-2025-48583 | High | 7.8 | 2025-12-08 | In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalati… |
CVE-2025-48580 | High | 7.8 | 2025-12-08 | In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the c… |
CVE-2025-48576 | Medium | 5.5 | 2025-12-08 | In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to resource exh… |
CVE-2025-48575 | High | 7.8 | 2025-12-08 | In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local escalation o… |
CVE-2025-48573 | High | 7.8 | 2025-12-08 | In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS while-in-use… |
CVE-2025-48572 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of pri… |
CVE-2025-48566 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation. This could lead to local e… |
CVE-2025-48565 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code. This could lead to local escalation… |
CVE-2025-48564 | High | 7.0 | 2025-12-08 | In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no additional ex… |
CVE-2025-48555 | High | 7.8 | 2025-12-08 | In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy. This could lead to local… |
CVE-2025-48536 | High | 7.8 | 2025-12-08 | In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused… |
CVE-2025-48525 | High | 7.8 | 2025-12-08 | In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications when not associated to a companion device… |
CVE-2025-32329 | High | 7.8 | 2025-12-08 | In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. Thi… |
CVE-2025-32328 | High | 7.8 | 2025-12-08 | In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code. Thi… |
CVE-2025-32319 | Medium | 6.7 | 2025-12-08 | In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions due to a permissions bypass. This could… |
CVE-2025-22432 | Medium | 6.7 | 2025-12-08 | In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input validation. This could lead to local escalat… |
CVE-2025-22420 | High | 7.8 | 2025-12-08 | In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy. This could lead to local escalation of privil… |
CVE-2025-14111 | Medium | 5.0 | 2025-12-05 | A security vulnerability has been detected in Rarlab RAR App up to 7.11 Build 127 on Android. This affects an unknown part of the component com.rarlab.rar. Suc… |
CVE-2025-13992 | Medium | 4.7 | 2025-12-03 | Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a cra… |
CVE-2025-13721 | High | 7.5 | 2025-12-02 | Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security… |
CVE-2025-13720 | High | 8.8 | 2025-12-02 | Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corru… |
CVE-2025-13640 | Low | 3.5 | 2025-12-02 | Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical access to the… |
CVE-2025-13639 | High | 8.1 | 2025-12-02 | Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pag… |
CVE-2025-13638 | High | 8.8 | 2025-12-02 | Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2025-13637 | Medium | 4.3 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestu… |
CVE-2025-13636 | Medium | 4.3 | 2025-12-02 | Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gest… |
CVE-2025-13635 | Medium | 4.4 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a local attacker to perform UI spoofing via a crafted HTML page. (Chr… |
CVE-2025-13634 | Medium | 4.4 | 2025-12-02 | Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted H… |
CVE-2025-13633 | High | 8.8 | 2025-12-02 | Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially… |
CVE-2025-13632 | Medium | 5.4 | 2025-12-02 | Inappropriate implementation in DevTools in Google Chrome prior to 143.0.7499.41 allowed an attacker who convinced a user to install a malicious extension to p… |
CVE-2025-13631 | High | 8.8 | 2025-12-02 | Inappropriate implementation in Google Updater in Google Chrome on Mac prior to 143.0.7499.41 allowed a remote attacker to perform privilege escalation via a c… |
CVE-2025-13630 | High | 8.8 | 2025-12-02 | Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13876 | Medium | 5.3 | 2025-12-02 | A security vulnerability has been detected in Rareprob HD Video Player All Formats App 12.1.372 on Android. Impacted is an unknown function of the component co… |
CVE-2025-20789 | Medium | 4.4 | 2025-12-02 | In GPU pdma, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional execu… |
CVE-2025-20788 | Medium | 4.4 | 2025-12-02 | In GPU pdma, there is a possible memory corruption due to a missing permission check. This could lead to local denial of service with no additional execution p… |
CVE-2025-20777 | Medium | 6.7 | 2025-12-02 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20776 | Medium | 6.7 | 2025-12-02 | In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alr… |
CVE-2025-20775 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20774 | Medium | 6.7 | 2025-12-02 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20773 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20772 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20771 | Medium | 6.7 | 2025-12-02 | In display, there is a possible escalation of privilege due to improper input validation. This could lead to local escalation of privilege if a malicious actor… |
CVE-2025-20770 | Medium | 6.7 | 2025-12-02 | In display, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obta… |
CVE-2025-20769 | Medium | 6.7 | 2025-12-02 | In display, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has al… |
CVE-2025-20768 | High | 7.8 | 2025-12-02 | In display, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alr… |
CVE-2025-20767 | High | 7.8 | 2025-12-02 | In display, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege if a malicious actor has alrea… |
CVE-2025-20766 | High | 7.8 | 2025-12-02 | In display, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege if a malicious actor has a… |
CVE-2025-20765 | Medium | 4.7 | 2025-12-02 | In aee daemon, there is a possible system crash due to a race condition. This could lead to local denial of service if a malicious actor has already obtained t… |
CVE-2025-20764 | High | 7.8 | 2025-12-02 | In smi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alread… |
CVE-2025-20763 | High | 7.8 | 2025-12-02 | In mmdvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has alr… |
CVE-2025-61619 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61618 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61617 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61610 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61609 | High | 7.5 | 2025-12-01 | In modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privilege… |
CVE-2025-61608 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-61607 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-3012 | High | 7.5 | 2025-12-01 | In dpc modem, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-11133 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-11132 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-11131 | High | 7.5 | 2025-12-01 | In nr modem, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privil… |
CVE-2025-13437 | | 2025-11-20 | When zx is invoked with --prefer-local=<path>, the CLI creates a symlink named ./node_modules pointing to <path>/node_modules. Due to a logic error in src/cli… | |
CVE-2025-13425 | | 2025-11-20 | A bug in the filesystem traversal fallback path causes fs/diriterate/diriterate.go:Next() to overindex an empty slice when ReadDir returns nil for an empty dir… | |
CVE-2025-48593 | High | 8.0 | 2025-11-18 | In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution… |
CVE-2025-13230 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13229 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13228 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2025-13227 | High | 8.8 | 2025-11-18 | Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |