Tracked app vulnerabilities

HIGH 7.1

Microsoft Word

2026-05-12

Improper access control in Microsoft Office Word allows an authorized attacker to perform spoofing locally.

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages f…

In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed.

In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges …

In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remo…

Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbitrary physical memory pages. Under ce…

A web page that contains unusual WebGPU content loaded into the GPU GLES render process and can trigger write UAF crash in the GPU GLES user-space shared libra…

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure Pres…

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: add missing return after LLCP_CLOSED checks In nfc_llcp_recv_hdlc() and nfc_ll…

Software installed and run as a non-privileged user may conduct improper GPU system calls to gain write permission to read-only wrapped user-mode memory and fi…

HIGH 8.8

Google Chrome

2026-04-15

Use after free in XR in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML p…

HIGH 7.5

Google Chrome

2026-04-15

Use after free in Payments in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestures…

HIGH 8.8

Google Chrome

2026-04-15

Use after free in Permissions in Google Chrome on Android prior to 147.0.7727.101 allowed a remote attacker who convinced a user to engage in specific UI gestu…

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a …

In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a …

Transient DOS when receiving a service data frame with excessive length during device matching over a neighborhood awareness network protocol connection.

Memory Corruption when using deprecated DMABUF IOCTL calls to manage video memory.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing in a camera sensor driver.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory Corruption when processing auxiliary sensor input/output control commands with insufficient buffer size validation.

Memory Corruption when accessing an output buffer without validating its size during IOCTL processing.

Memory Corruption when sending IOCTL requests with invalid buffer sizes during memcpy operations.

Transient DOS when processing nonstandard FILS Discovery Frames with out-of-range action sizes during initial scans.

Cryptographic issue while copying data to a destination buffer without validating its size.

Memory corruption when decoding corrupted satellite data files with invalid signature offsets.

HIGH 7.1

+10

2026-03-16

AI command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.

HIGH · vendor

Microsoft Copilot

2026-03-10

Integer overflow or wraparound in Microsoft Office allows an authorized attacker to elevate privileges locally.

HIGH · vendor

Microsoft Copilot

Windows

2026-03-10

Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.

HIGH · vendor

Microsoft Copilot

Windows

2026-03-10

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

HIGH 8.8

Google Chrome

2026-03-04

Object lifecycle issue in PowerVR in Google Chrome on Android prior to 145.0.7632.159 allowed a remote attacker to potentially exploit heap corruption via a cr…

In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This co…

In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. Th…

In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to lo…

In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation o…

In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This co…

In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to loca…

In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. Th…

In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalatio…

In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local esca…

In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead t…

In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privileg…

In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of …

In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with …

In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional…