Android
Android June 2026 patch level
Official advisory122 CVEs fixed by this release.
- Release date
- 2026-06-01
- End of support
- —
- CVEs fixed
- 122
- CISA KEV
- 1
- Critical
- 3
- High
- 83
- NVD pending
- 0
CVEs fixed
| CVE | Severity | KEV | Published | Description |
|---|---|---|---|---|
|
CVE-2025-48595
KEV
In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to… |
HIGH 8.4 | KEV | In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no a… | |
|
CVE-2026-25276
Memory corruption while using Strongbox due to missing bounds check. |
HIGH 8.8 | — | Memory corruption while using Strongbox due to missing bounds check. | |
|
CVE-2026-25277
Memory corruption while using Strongbox due to buffer overflow. |
HIGH 8.8 | — | Memory corruption while using Strongbox due to buffer overflow. | |
|
CVE-2025-48581
In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in th… |
HIGH 8.4 | — | In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code. This could lead to local escalat… | |
|
CVE-2026-0095
In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged… |
HIGH 8.0 | — | In l2c_fcr_clone_buf of l2c_fcr.cc, there is a possible way to trigger controlled heap corruption within the privileged Bluetooth process due to an integer ove… | |
|
CVE-2026-0097
In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic erro… |
HIGH 8.0 | — | In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. This could lead to remote (proximal/a… | |
|
CVE-2026-0059
In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overf… |
HIGH 8.0 | — | In multiple functions of sdp_discovery.cc, there is a possible way to achieve code execution due to a heap buffer overflow. This could lead to remote (proximal… | |
|
CVE-2026-20432
In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation o… |
HIGH 8.0 | — | In Modem, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege, if a UE has connected to a … | |
|
CVE-2025-59604
Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer. |
HIGH 7.8 | — | Memory Corruption when running a memory copy operation due to invalid writes caused by a null pointer. | |
|
CVE-2025-59605
Memory Corruption when processing device identifier strings that exceed the expected maximum length. |
HIGH 7.8 | — | Memory Corruption when processing device identifier strings that exceed the expected maximum length. | |
|
CVE-2025-59606
Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data init… |
HIGH 7.8 | — | Memory Corruption when writing to invalid memory locations occurs due to heap memory exhaustion during secure data initialization. | |
|
CVE-2026-28580
In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to l… |
HIGH 7.8 | — | In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no add… | |
|
CVE-2026-28577
In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. Thi… |
HIGH 7.8 | — | In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of priv… | |
|
CVE-2026-0096
In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to m… |
HIGH 7.8 | — | In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to misleading or insufficient UI. This could… | |
|
CVE-2026-0098
In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confuse… |
HIGH 7.8 | — | In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escal… | |
|
CVE-2026-0099
In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to… |
HIGH 7.8 | — | In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could l… | |
|
CVE-2026-0100
In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to lo… |
HIGH 7.8 | — | In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no addi… | |
|
CVE-2026-0087
In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app… |
HIGH 7.8 | — | In approvalLevelForDomainInternal of DomainVerificationService.java, there is a possible way to hijack an arbitrary app link due to a logic error in the code. … | |
|
CVE-2026-0088
In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misle… |
HIGH 7.8 | — | In getCallingAppLabel of CertInstaller.java, there is a possible way to hide a sensitive security dialogue due to misleading or insufficient UI. This could lea… | |
|
CVE-2026-0089
In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a miss… |
HIGH 7.8 | — | In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a missing permission check. This could lead to… | |
|
CVE-2026-0091
In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell … |
HIGH 7.8 | — | In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user. This could lead to local escalatio… | |
|
CVE-2026-0093
In multiple locations, there is a possible misleading UI due to obfuscation. This could lead to local escalation of pri… |
HIGH 7.8 | — | In multiple locations, there is a possible misleading UI due to obfuscation. This could lead to local escalation of privilege with no additional execution priv… | |
|
CVE-2026-0094
In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to cer… |
HIGH 7.8 | — | In getApplicationLabel of KeyChainActivity.java, there is a possible way to trick the user into approving access to certificates due to misleading or insuffici… | |
|
CVE-2026-0076
In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. This cou… |
HIGH 7.8 | — | In validateNode of ResourceTypes.cpp, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local escalation of privilege… | |
|
CVE-2026-0077
In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a… |
HIGH 7.8 | — | In resumeConfigurationDispatch of ActivityRecord.java, there is a possible background application launch (bal) due to a logic error in the code. This could lea… | |
|
CVE-2026-0078
In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input v… |
HIGH 7.8 | — | In setGlobalProxy of DevicePolicyManagerService.java, there is a possible desync in persistence due to improper input validation. This could lead to local esca… | |
|
CVE-2026-0045
In bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure connection due to a logic… |
HIGH 7.8 | — | In bta_jv_rfcomm_connect of bta_jv_act.cc, there is a possible bypass of bonding for a secure connection due to a logic error in the code. This could lead to l… | |
|
CVE-2025-48652
In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error i… |
HIGH 7.8 | — | In performPreInstallChecks of InstallRepository.kt, there is a possible way to bypass MDM policy due to a logic error in the code. This could lead to local esc… | |
|
CVE-2026-0009
In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escala… |
HIGH 7.8 | — | In multiple locations, there is a possible tapjacking due to a logic error in the code. This could lead to local escalation of privilege with no additional exe… | |
|
CVE-2026-0036
In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. Th… |
HIGH 7.8 | — | In startAnimation of StageCoordinator.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of pri… | |
|
CVE-2025-48649
In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypas… |
HIGH 7.8 | — | In multiple locations, there is a possible way to reset user-selected permissions selections due to a permissions bypass. This could lead to local escalation o… | |
|
CVE-2025-22424
In multiple locations, there is a possible way to reveal images across users due to improper input validation. This cou… |
HIGH 7.8 | — | In multiple locations, there is a possible way to reveal images across users due to improper input validation. This could lead to local escalation of privilege… | |
|
CVE-2025-22426
In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in t… |
HIGH 7.8 | — | In many functions of ComputerEngine.java, there is a possible way to access URIs across users due to a logic error in the code. This could lead to local escala… | |
|
CVE-2025-26418
In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when… |
HIGH 7.8 | — | In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device d… | |
|
CVE-2025-32348
In multiple locations, there is a possible background activity launch due to a missing permission check. This could lea… |
HIGH 7.8 | — | In multiple locations, there is a possible background activity launch due to a missing permission check. This could lead to local escalation of privilege with … | |
|
CVE-2025-48570
In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due t… |
HIGH 7.8 | — | In multiple functions of PipTaskOrganizer.java, there is a possible way to launch an activity from the background due to a confused deputy. This could lead to … | |
|
CVE-2026-20455
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio… |
HIGH 7.8 | — | In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has … | |
|
CVE-2026-22167
Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbi… |
HIGH 7.8 | — | Software installed and run as a non-privileged user may conduct improper GPU system calls to force GPU to write to arbitrary physical memory pages. Under ce… | |
|
CVE-2025-48615
In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaus… |
HIGH 7.8 | — | In getComponentName of MediaButtonReceiverHolder.java, there is a possible desync in persistence due to resource exhaustion. This could lead to local escalatio… | |
|
CVE-2025-48612
In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's defa… |
HIGH 7.8 | — | In setDefaultKey of DefaultPaymentSettings.java, there is a possible way for an application to set the main user's default NFC payment setting due to improper … | |
|
CVE-2025-40214
In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). … |
HIGH 7.8 | — | In the Linux kernel, the following vulnerability has been resolved: af_unix: Initialise scc_index in unix_add_edge(). Quang Le reported that the AF_UNIX GC c… | |
|
CVE-2025-71255
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additi… |
HIGH 7.5 | — | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. | |
|
CVE-2025-71256
In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additio… |
HIGH 7.5 | — | In nr modem, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. | |
|
CVE-2025-71252
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additi… |
HIGH 7.5 | — | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. | |
|
CVE-2025-71253
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additi… |
HIGH 7.5 | — | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. | |
|
CVE-2025-71254
In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additi… |
HIGH 7.5 | — | In Modem IMS, there is a possible improper input validation. This could lead to remote denial of service with no additional execution privileges needed. | |
|
CVE-2025-71251
In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service … |
HIGH 7.5 | — | In IMS, there is a possible system crash due to improper input validation. This could lead to remote denial of service with no additional execution privileges … | |
|
CVE-2026-24085
Memory Corruption when processing display command line information due to improper initialization of a variable. |
HIGH 7.2 | — | Memory Corruption when processing display command line information due to improper initialization of a variable. | |
|
CVE-2026-24089
Memory corruption while processing fastboot commands with invalid input. |
HIGH 7.2 | — | Memory corruption while processing fastboot commands with invalid input. | |
|
CVE-2025-64720
LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication |
HIGH 7.1 | — | LIBPNG is vulnerable to a buffer overflow in `png_image_read_composite` via incorrect palette premultiplication | |
|
CVE-2025-65018
LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` |
HIGH 7.1 | — | LIBPNG is vulnerable to a heap buffer overflow in `png_combine_row` triggered via `png_image_finish_read` | |
|
CVE-2026-0086
In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null … |
MEDIUM 6.8 | — | In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check. This could lead to local escalati… | |
|
CVE-2026-0048
In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/o… |
MEDIUM 6.8 | — | In hide of WindowState.java, there is a possible way to trick the user into approving permissions due to a tapjacking/overlay attack. This could lead to local … | |
|
CVE-2026-20453
In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalatio… |
MEDIUM 6.7 | — | In geniezone, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has … | |
|
CVE-2026-0080
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo… |
MEDIUM 6.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. This could lead to remote denial of s… | |
|
CVE-2026-0044
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause the system to crash due to an int… |
MEDIUM 6.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause the system to crash due to an integer overflow. This could lead to remote… | |
|
CVE-2026-0051
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper in… |
MEDIUM 6.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a system crash due to improper input validation. This could lead to remot… | |
|
CVE-2026-0052
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo… |
MEDIUM 6.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. This could lead to remote denial of s… | |
|
CVE-2026-0039
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer… |
MEDIUM 6.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to remote den… | |
|
CVE-2026-0040
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflo… |
MEDIUM 6.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a crash due to an integer overflow. This could lead to remote denial of s… | |
|
CVE-2026-0041
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This… |
MEDIUM 6.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible UBSan failure due to an integer overflow. This could lead to remote denial of service … | |
|
CVE-2026-20431
In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE h… |
MEDIUM 6.5 | — | In Modem, there is a possible system crash due to a logic error. This could lead to remote denial of service, if a UE has connected to a rogue base station con… | |
|
CVE-2026-20454
In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of p… |
MEDIUM 6.4 | — | In geniezone, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege if a malicious actor has alread… | |
|
CVE-2026-0046
In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tap… |
MEDIUM 6.2 | — | In InputInterceptor of Letterbox.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead … | |
|
CVE-2026-0055
In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC… |
MEDIUM 6.2 | — | In createSessionInternal of PackageInstallerService.java, there is a possible to update a Device Policy Controller (DPC) into an invalid directory due to a pat… | |
|
CVE-2025-64505
[Apple ImageIO] Processing a maliciously crafted file may lead to unexpected app termination |
MEDIUM 6.1 | — | [Apple ImageIO] Processing a maliciously crafted file may lead to unexpected app termination | |
|
CVE-2026-0061
In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a… |
MEDIUM 5.9 | — | In multiple functions of WindowState.java, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could l… | |
|
CVE-2026-0075
In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead … |
MEDIUM 5.9 | — | In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no… | |
|
CVE-2026-28578
In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper i… |
MEDIUM 5.5 | — | In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. This could lead to loca… | |
|
CVE-2026-0079
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer… |
MEDIUM 5.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to local deni… | |
|
CVE-2026-0085
In applySimpleFieldMaxSize of DataRowHandler.java, there is a possible way to insert a large contact name due to improp… |
MEDIUM 5.5 | — | In applySimpleFieldMaxSize of DataRowHandler.java, there is a possible way to insert a large contact name due to improper input validation. This could lead to … | |
|
CVE-2026-0060
In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, there is a possible persistent dos issue due … |
MEDIUM 5.5 | — | In updateState of GraphicsDriverEnableAngleAsSystemDriverController.java, there is a possible persistent dos issue due to an unusual root cause. This could lea… | |
|
CVE-2026-0067
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a permanent denial of service due… |
MEDIUM 5.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible way to cause a permanent denial of service due to a logic error in the code. This coul… | |
|
CVE-2026-0069
In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This coul… |
MEDIUM 5.5 | — | In verifySignature of ApkChecksums.java, there is a possible way to cause a crash due to resource exhaustion. This could lead to local denial of service with n… | |
|
CVE-2026-0070
In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due… |
MEDIUM 5.5 | — | In multiple functions of DevicePolicyManagerService.java, there is a possible way to hide a system critical package due to improper input validation. This coul… | |
|
CVE-2026-0074
In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service due to resource exhausti… |
MEDIUM 5.5 | — | In getPreferredSize of LauncherProcessImageListener.kt, there is a possible denial of service due to resource exhaustion. This could lead to local denial of s… | |
|
CVE-2026-0043
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer… |
MEDIUM 5.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to an integer overflow. This could lead to local esca… | |
|
CVE-2026-0018
In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to impr… |
MEDIUM 5.5 | — | In multiple functions of AccessibilityManagerService.java, there is a possible persistent denial of service due to improper input validation. This could lead t… | |
|
CVE-2026-0042
In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to resource e… |
MEDIUM 5.5 | — | In multiple functions of ubsan_throwing_runtime.cpp, there is a possible persistent denial of service due to resource exhaustion. This could lead to local deni… | |
|
CVE-2025-48648
In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. This co… |
MEDIUM 5.5 | — | In isSameApp of NotificationManagerService.java, there is a possible persistent dos due to resource exhaustion. This could lead to local denial of service with… | |
|
CVE-2025-48600
In multiple files, there is a possible way to reveal information across users due to a missing permission check. This c… |
MEDIUM 5.5 | — | In multiple files, there is a possible way to reveal information across users due to a missing permission check. This could lead to local information disclosur… | |
|
CVE-2026-28581
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a… |
MEDIUM 4.0 | — | In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code. This could lea… | |
|
CVE-2026-28586
In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. … |
LOW 3.3 | — | In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information dis… | |
|
CVE-2026-0050
In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permiss… |
LOW 3.3 | — | In handleBondStateChanged of AdapterService.java, there is a possible sensitive information disclosure due to a permissions bypass. This could lead to local in… | |
|
CVE-2026-0056
In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead… |
LOW 3.3 | — | In setTo of ResourceTypes.cpp, there is a possible read out of bounds due to an incorrect bounds check. This could lead to local information disclosure with no… | |
|
CVE-2026-0016
In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings acr… |
LOW 3.3 | — | In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass. T… | |
|
CVE-2025-48616
In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinnin… |
LOW 3.3 | — | In multiple functions of KeyguardViewMediator.java , there is a possible way to bypass lockdown mode with screen pinning due to a logic error in the code. This… | |
|
CVE-2025-47384
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2025-47392
Indexed via Android Security Bulletin; full NVD metadata pending. |
CRITICAL | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2025-47400
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2025-47401
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2025-47403
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-20433
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-20435
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-20447
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-20448
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-20449
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-20450
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21352
Indexed via Android Security Bulletin; full NVD metadata pending. |
CRITICAL | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21353
Indexed via Android Security Bulletin; full NVD metadata pending. |
CRITICAL | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21367
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21372
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21373
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21374
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21375
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21376
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21378
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21380
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21381
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21538
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21539
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21540
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21541
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21542
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21543
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21544
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21545
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21546
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21547
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-21736
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-22163
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. | |
|
CVE-2026-28574
Indexed via Android Security Bulletin; full NVD metadata pending. |
HIGH | — | Indexed via Android Security Bulletin; full NVD metadata pending. |