| CVE-2026-28671 |
In updateInternal of MediaProvider.java, there is a possible expose contents of files due to a race condition
|
3.3
Low
|
Sep 8, 2026 |
| CVE-2026-28668 |
In LimitRealloc of malloc_limit.cpp, there is a possible use after free due to a logic error in the code
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28666 |
In multiple functions of LocalImageResolver.java, there is a possible Remote Persistent Denial of Service due to a DNG…
|
8.8
High
|
Sep 8, 2026 |
| CVE-2026-28664 |
In WriteImageToDisk of runtime_image.cc, there is a possible file tampering due to a logic error in the code
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28663 |
In buildIntentSenderForUser of LauncherAppsService.java, there is a possible way to launch an activity from the…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28662 |
In p2p_process_prov_disc_bootstrap_req of p2p_pd.c, there is a possible out of bounds write due to a heap buffer…
|
8.0
High
|
Sep 8, 2026 |
| CVE-2026-28660 |
In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code
|
3.3
Low
|
Sep 8, 2026 |
| CVE-2026-28658 |
In findMetaAuthUid of AccountsDb.java, there is a possible frp bypass due to a logic error in the code
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28657 |
In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28656 |
In multiple functions of DeviceAdminAdd.java, there is a possible way to an overlay due to a tapjacking/overlay attack
|
7.3
High
|
Sep 8, 2026 |
| CVE-2026-28655 |
In multiple functions of RemoteViews.java, there is a possible background activity launch bypass due to a logic error in…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28653 |
In multiple functions of rw_t3t.cc, there is a possible out of bounds write due to an integer overflow
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28652 |
In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check
|
3.1
Low
|
Sep 8, 2026 |
| CVE-2026-28650 |
In setHiddenWhileSuspended of WindowState.java, there is a possible overlay bypass due to a logic error in the code
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28644 |
In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28642 |
In executeRequest of ActivityStarter.java, there is a possible background activity launch due to a logic error in the…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28639 |
In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a logic error in the code
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28638 |
In multiple functions of XmpDataParser.java, there is a possible improper data sanitization due to a logic error in…
|
3.3
Low
|
Sep 8, 2026 |
| CVE-2026-28636 |
In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28634 |
In handleUssdRequest of PhoneInterfaceManager.java, there is a possible way to send a USSD request without permission…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28633 |
In initForUserNoTracing of VoiceInteractionManagerService.java, there is a possible persistent denial of service due…
|
5.5
Medium
|
Sep 8, 2026 |
| CVE-2026-28631 |
In buildMiniResolver of IntentForwarderActivity.java, there is a possible consent bypass due to a tapjacking/overlay…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28630 |
In onCreate of ContactsPickerActivity.kt, there is a possible misleading UI due to a tapjacking/overlay attack
|
3.3
Low
|
Sep 8, 2026 |
| CVE-2026-28627 |
In btm_sec_encrypt_change of btm_sec.cc, there is a possible downgrade attack due to a logic error in the code
|
4.3
Medium
|
Sep 8, 2026 |
| CVE-2026-28626 |
In onCreate of SetupPassthroughActivity.java, there is a possible way to launch arbitrary activity due to Intent…
|
7.3
High
|
Sep 8, 2026 |