Page 29 of 100 — Google CVEs from a corpus of 15879, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-0077 | Medium | 4.0 | 2025-09-04 | In multiple functions of UserController.java, there is a possible lock screen bypass due to a race condition. This could lead to local escalation of privilege… |
CVE-2024-49739 | Medium | 4.0 | 2025-09-04 | In MMapVAccess of pmr_os.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with no… |
CVE-2023-35657 | Medium | 4.0 | 2025-09-04 | In bta_av_config_ind of bta_av_aact.cc, there is a possible out of bounds read due to type confusion. This could lead to local information disclosure with no a… |
CVE-2025-36909 | Medium | 5.3 | 2025-09-04 | Information disclosure |
CVE-2025-36908 | Medium | 6.7 | 2025-09-04 | In lwis_top_register_io of lwis_device_top.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of… |
CVE-2025-36907 | High | 7.3 | 2025-09-04 | In draw_surface_image() of abl/android/lib/draw/draw.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalat… |
CVE-2025-36906 | High | 7.8 | 2025-09-04 | In ConvertReductionOp of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escala… |
CVE-2025-36905 | High | 7.8 | 2025-09-04 | In gxp_mapping_create of gxp_mapping.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local escalation of privi… |
CVE-2025-36904 | Critical | 9.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384. |
CVE-2025-36903 | High | 7.8 | 2025-09-04 | In lwis_io_buffer_write, there is a possible OOB read/write due to improper input validation. This could lead to local escalation of privilege with no addition… |
CVE-2025-36902 | Medium | 6.7 | 2025-09-04 | In syna_cdev_ioctl_store_pid() of syna_tcm2_sysfs.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation… |
CVE-2025-36901 | High | 8.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223. |
CVE-2025-36900 | Medium | 6.7 | 2025-09-04 | In lwis_test_register_io of lwis_device_test.c, there is a possible OOB Write due to an integer overflow. This could lead to local escalation of privilege with… |
CVE-2025-36899 | High | 8.4 | 2025-09-04 | There is a possible escalation of privilege due to test/debugging code left in a production build. This could lead to physical escalation of privilege with no… |
CVE-2025-36898 | High | 7.8 | 2025-09-04 | There is a possible escalation of privilege due to a logic error in the code. This could lead to local escalation of privilege with no additional execution pri… |
CVE-2025-36897 | Critical | 9.8 | 2025-09-04 | In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no… |
CVE-2025-36896 | Critical | 9.8 | 2025-09-04 | WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106. |
CVE-2025-36895 | High | 7.5 | 2025-09-04 | Information disclosure |
CVE-2025-36894 | High | 7.5 | 2025-09-04 | In TBD of TBD, there is a possible DoS due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed… |
CVE-2025-36893 | Medium | 5.5 | 2025-09-04 | In ReadTachyonCommands of gxp_main_actor.cc, there is a possible information leak due to uninitialized data. This could lead to local information disclosure wi… |
CVE-2025-36892 | High | 7.5 | 2025-09-04 | Denial of service |
CVE-2025-36891 | High | 8.8 | 2025-09-04 | Elevation of privilege |
CVE-2025-36890 | Critical | 9.8 | 2025-09-04 | Elevation of Privilege |
CVE-2025-36887 | High | 7.8 | 2025-09-04 | In wl_cfgscan_update_v3_schedscan_results() of wl_cfgscan.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to loca… |
CVE-2024-56190 | High | 7.8 | 2025-09-04 | In wl_update_hidden_ap_ie() of wl_cfgscan.c, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of p… |
CVE-2024-56189 | Medium | 6.5 | 2025-09-04 | In SAEMM_DiscloseMsId of SAEMM_RadioMessageCodec.c, there is a possible out of bounds read due to a missing bounds check. This could lead to remote information… |
CVE-2025-9867 | Medium | 5.4 | 2025-09-03 | Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTM… |
CVE-2025-9866 | High | 8.8 | 2025-09-03 | Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HT… |
CVE-2025-9865 | Medium | 5.4 | 2025-09-03 | Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific… |
CVE-2025-21035 | Medium | 4.6 | 2025-09-03 | Improper access control in Samsung Calendar prior to version 12.5.06.5 in Android 14 and 12.6.01.12 in Android 15 allows physical attackers to access data acro… |
CVE-2023-21482 | Medium | 6.1 | 2025-09-03 | Missing authorization vulnerability in Camera prior to versions 11.1.02.18 in Android 11, 12.1.03.8 in Android 12 and 13.1.01.4 in Android 13 allows physical… |
CVE-2025-26416 | Critical | 9.8 | 2025-09-02 | In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of… |
CVE-2025-22442 | High | 7.0 | 2025-09-02 | In multiple functions of DevicePolicyManagerService.java, there is a possible way to install unauthorized applications into a newly created work profile due to… |
CVE-2025-22439 | High | 7.3 | 2025-09-02 | In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing permission check. This… |
CVE-2025-22438 | High | 7.8 | 2025-09-02 | In afterKeyEventLockedInterruptable of InputDispatcher.cpp, there is a possible use after free. This could lead to local escalation of privilege with no additi… |
CVE-2025-22437 | High | 7.8 | 2025-09-02 | In setMediaButtonReceiver of multiple files, there is a possible way to launch arbitrary activities from background due to a logic error in the code. This coul… |
CVE-2025-22435 | Critical | 9.8 | 2025-09-02 | In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion. This could lead to paired device escalation of privilege with no a… |
CVE-2025-22434 | High | 7.8 | 2025-09-02 | In handleKeyGestureEvent of PhoneWindowManager.java, there is a possible lock screen bypass due to a logic error in the code. This could lead to local escalati… |
CVE-2025-22433 | High | 7.8 | 2025-09-02 | In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work Profile scenarios due t… |
CVE-2025-22431 | Medium | 5.5 | 2025-09-02 | In multiple locations, there is a possible method for a malicious app to prevent dialing emergency services under limited circumstances due to a logic error in… |
CVE-2025-22430 | Medium | 5.5 | 2025-09-02 | In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing permission check. This could lead to local… |
CVE-2025-22429 | Critical | 9.8 | 2025-09-02 | In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege wit… |
CVE-2025-22428 | High | 7.8 | 2025-09-02 | In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible way to grant permissions to an app on the secondary user from the primary user… |
CVE-2025-22427 | High | 7.3 | 2025-09-02 | In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way to grant notification access above the lock screen due to a logic error in… |
CVE-2025-22423 | High | 7.5 | 2025-09-02 | In ParseTag of dng_ifd.cpp, there is a possible way to crash the image renderer due to a missing bounds check. This could lead to remote denial of service with… |
CVE-2025-22422 | High | 7.8 | 2025-09-02 | In multiple locations, there is a possible way to mislead a user into approving an authentication prompt for one app when its result will be used in another du… |
CVE-2025-22421 | Medium | 5.5 | 2025-09-02 | In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due to a logic error i… |
CVE-2025-22419 | High | 7.3 | 2025-09-02 | In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overlay attack. This coul… |
CVE-2025-22418 | High | 7.8 | 2025-09-02 | In multiple locations, there is a possible confused deputy due to Intent Redirect. This could lead to local escalation of privilege with no additional executio… |
CVE-2025-22417 | High | 7.3 | 2025-09-02 | In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack. This could lead to l… |
CVE-2025-22416 | High | 7.8 | 2025-09-02 | In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy. This could lead to local escalation of priv… |
CVE-2024-49730 | High | 7.8 | 2025-09-02 | In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption. This could lead to local escalation of privilege with no additional execut… |
CVE-2024-49728 | Medium | 5.5 | 2025-09-02 | In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy. This could lead to local inform… |
CVE-2024-49722 | Medium | 5.5 | 2025-09-02 | In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy. This could lead to local information d… |
CVE-2024-49720 | High | 7.8 | 2025-09-02 | In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic error in the code. T… |
CVE-2024-40653 | High | 7.3 | 2025-09-02 | In multiple functions of ConnectionServiceWrapper.java, there is a possible way to retain a permission forever in the background due to a logic error in the co… |
CVE-2025-20707 | Medium | 6.7 | 2025-09-01 | In geniezone, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already ob… |
CVE-2025-20706 | High | 7.8 | 2025-09-01 | In mbrain, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtai… |
CVE-2025-20705 | High | 7.8 | 2025-09-01 | In monitor_hang, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already… |
CVE-2025-9695 | Medium | 5.3 | 2025-08-30 | A vulnerability was identified in GalleryVault Gallery Vault App up to 4.5.2 on Android. Affected by this issue is some unknown functionality of the file Andro… |
CVE-2025-9677 | Medium | 5.3 | 2025-08-29 | A security flaw has been discovered in Modo Legend of the Phoenix up to 1.0.5. The affected element is an unknown function of the file AndroidManifest.xml of t… |
CVE-2025-9675 | Medium | 5.3 | 2025-08-29 | A vulnerability was determined in Voice Changer App up to 1.1.0. This issue affects some unknown processing of the file AndroidManifest.xml of the component co… |
CVE-2025-9674 | Medium | 5.3 | 2025-08-29 | A flaw has been found in Transbyte Scooper News App up to 1.2 on Android. Affected by this issue is some unknown functionality of the file AndroidManifest.xml… |
CVE-2025-26417 | Medium | 4.0 | 2025-08-26 | In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage due to a confused… |
CVE-2025-22413 | Medium | 4.0 | 2025-08-26 | In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code. This could lead to local information disclosure… |
CVE-2025-22412 | High | 8.8 | 2025-08-26 | In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjacent) code… |
CVE-2025-22411 | High | 8.8 | 2025-08-26 | In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code. This could lead to remote (proximal/adjac… |
CVE-2025-22410 | High | 8.4 | 2025-08-26 | In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no addi… |
CVE-2025-22409 | High | 8.4 | 2025-08-26 | In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of priv… |
CVE-2025-22408 | Critical | 9.8 | 2025-08-26 | In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code execution with… |
CVE-2025-22407 | Medium | 5.5 | 2025-08-26 | In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local information disc… |
CVE-2025-22406 | High | 8.4 | 2025-08-26 | In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free. This could lead to local escalation of… |
CVE-2025-22405 | High | 8.4 | 2025-08-26 | In multiple locations, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privilege with no addi… |
CVE-2025-22404 | High | 8.4 | 2025-08-26 | In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to local escalation of privi… |
CVE-2025-22403 | Critical | 9.8 | 2025-08-26 | In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code ex… |
CVE-2025-0093 | High | 7.5 | 2025-08-26 | In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check. This could lead to remote infor… |
CVE-2025-0092 | Medium | 6.5 | 2025-08-26 | In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficient UI. This could lead to remote (proxim… |
CVE-2025-0086 | Medium | 6.2 | 2025-08-26 | In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could lead to local informat… |
CVE-2025-0084 | High | 8.8 | 2025-08-26 | In multiple locations, there is a possible out of bounds write due to a use after free. This could lead to remote code execution over Bluetooth, if HFP support… |
CVE-2025-0083 | Medium | 4.0 | 2025-08-26 | In multiple locations, there is a possible way to access content across user profiles due to URI double encoding. This could lead to local information disclosu… |
CVE-2025-0082 | Medium | 5.5 | 2025-08-26 | In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across users due to a confused deputy. This coul… |
CVE-2025-0081 | High | 7.5 | 2025-08-26 | In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data. This could lead to remote den… |
CVE-2025-0080 | High | 7.8 | 2025-08-26 | In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This could lead to local esc… |
CVE-2025-0079 | High | 7.8 | 2025-08-26 | In multiple locations, there is a possible way that avdtp and avctp channels could be unencrypted due to a logic error in the code. This could lead to local es… |
CVE-2025-0078 | High | 8.8 | 2025-08-26 | In main of main.cpp, there is a possible way to bypass SELinux due to a logic error in the code. This could lead to local escalation of privilege with no addit… |
CVE-2025-0075 | Critical | 9.8 | 2025-08-26 | In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code… |
CVE-2025-0074 | Critical | 9.8 | 2025-08-26 | In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free. This could lead to remote code exec… |
CVE-2024-49740 | Medium | 5.5 | 2025-08-26 | In multiple locations, there is a possible crash loop due to resource exhaustion. This could lead to local denial of service with no additional execution privi… |
CVE-2023-21125 | High | 8.0 | 2025-08-26 | In btif_hh_hsdata_rpt_copy_cb of bta_hh.cc, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege… |
CVE-2025-9478 | High | 8.8 | 2025-08-26 | Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chr… |
CVE-2025-4609 | Critical | 9.6 | 2025-08-22 | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially per… |
CVE-2025-9132 | High | 8.8 | 2025-08-20 | Out of bounds write in V8 in Google Chrome prior to 139.0.7258.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (C… |
CVE-2025-8364 | Medium | 4.3 | 2025-08-19 | A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Androi… |
CVE-2025-8042 | Critical | 9.8 | 2025-08-19 | Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141. |
CVE-2025-8041 | Medium | 5.3 | 2025-08-19 | In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox… |
CVE-2025-4690 | Medium | 4.3 | 2025-08-19 | A regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to sup… |
CVE-2025-8901 | High | 8.8 | 2025-08-13 | Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page… |
CVE-2025-8882 | High | 8.8 | 2025-08-13 | Use after free in Aura in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially… |
CVE-2025-8881 | Medium | 6.5 | 2025-08-13 | Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI ge… |
CVE-2025-8880 | High | 8.8 | 2025-08-13 | Race in V8 in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium sec… |