| CVE-2026-28624 |
In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28623 |
In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due…
|
3.3
Low
|
Sep 8, 2026 |
| CVE-2026-28622 |
In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a…
|
3.3
Low
|
Sep 8, 2026 |
| CVE-2026-28620 |
In multiple locations, there is a possible unauthorized URI access due to a permissions bypass
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28618 |
In dec_frm_prepare of oapv.c, there is a possible OOB write due to a heap buffer overflow
|
8.8
High
|
Sep 8, 2026 |
| CVE-2026-28617 |
In add of WifiNetworkSuggestionsManager.java, there is a possible persistent DOS due to resource exhaustion
|
5.5
Medium
|
Sep 8, 2026 |
| CVE-2026-28616 |
In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28614 |
In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28613 |
In initAppLinkTypeAndIntent of ChannelImpl.java, there is a possible launch an arbitrary intent due to improper input…
|
7.3
High
|
Sep 8, 2026 |
| CVE-2026-28612 |
In resolveActivity of ActivityStarter.java, there is a possible way to perform Intent Redirection attacks due to a logic…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28611 |
In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28609 |
In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting
|
8.8
High
|
Sep 8, 2026 |
| CVE-2026-28607 |
In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28606 |
In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the…
|
9.8
Critical
|
Sep 8, 2026 |
| CVE-2026-28604 |
In multiple locations, there is a possible use after free due to a race condition
|
7.5
High
|
Sep 8, 2026 |
| CVE-2026-28603 |
In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28602 |
In setClipboardAccessNotificationsEnabledForUser of ClipboardService.java, there is a possible mult-iuser isolation…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28600 |
In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28599 |
In addCreatorToken of ActivityManagerService.java, there is a possible Intent Redirection Bypass due to a logic error in…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28596 |
In parseInterventionFromXml of GameManagerService.java, there is a possible permanent denial of service due to…
|
5.5
Medium
|
Sep 8, 2026 |
| CVE-2026-28594 |
In multiple locations, there is a possible use after free due to a logic error in the code
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28593 |
In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient…
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28590 |
In multiple locations, there is a possible improper encryption key validation due to a logic error in the code
|
7.8
High
|
Sep 8, 2026 |
| CVE-2026-28584 |
In createSessionInternal of PackageInstallerService.java, there is a possible way to permanently DoS the device due to a…
|
5.5
Medium
|
Sep 8, 2026 |
| CVE-2026-28583 |
In validate_camera_metadata_structure of camera_metadata.c, there is a possible out of bounds write due to a logical…
|
7.8
High
|
Sep 8, 2026 |