| CVE-2025-48566 |
In multiple locations, there is a possible permission bypass due to a confused deputy
|
7.8
High
|
Dec 8, 2025 |
| CVE-2025-48565 |
In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the…
|
7.8
High
|
Dec 8, 2025 |
| CVE-2025-48564 |
In multiple locations, there is a possible intent filter bypass due to a race condition
|
7.0
High
|
Dec 8, 2025 |
| CVE-2025-48555 |
In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a…
|
7.8
High
|
Dec 8, 2025 |
| CVE-2025-48536 |
In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to…
|
7.8
High
|
Dec 8, 2025 |
| CVE-2025-48525 |
In disassociate of DisassociationProcessor.java, there is a possible way for an app to continue reading notifications…
|
7.8
High
|
Dec 8, 2025 |
| CVE-2025-32329 |
In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the…
|
7.8
High
|
Dec 8, 2025 |
| CVE-2025-32328 |
In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the…
|
7.8
High
|
Dec 8, 2025 |
| CVE-2025-32319 |
In ensureBound of RemotePrintService.java, there is a possible way for a background app to keep foreground permissions…
|
6.7
Medium
|
Dec 8, 2025 |
| CVE-2025-22432 |
In notifyTimeout of CallRedirectionProcessor.java, there is a possible persistent connection due to improper input…
|
6.7
Medium
|
Dec 8, 2025 |
| CVE-2025-22420 |
In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy
|
7.8
High
|
Dec 8, 2025 |
| CVE-2025-48593 |
In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free
|
8.0
High
|
Nov 18, 2025 |
| CVE-2025-32320 |
In System UI, there is a possible way to view other users' images due to a confused deputy
|
7.8
High
|
Sep 5, 2025 |
| CVE-2025-32318 |
In Skia, there is a possible out of bounds write due to a heap buffer overflow
|
8.8
High
|
Sep 5, 2025 |
| CVE-2025-32317 |
In App Widget, there is a possible Information Disclosure due to a confused deputy
|
5.5
Medium
|
Sep 5, 2025 |
| CVE-2025-32316 |
In gralloc4, there is a possible out of bounds write due to a missing bounds check
|
5.5
Medium
|
Sep 5, 2025 |
| CVE-2025-26461 |
In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the…
|
3.3
Low
|
Sep 5, 2025 |
| CVE-2025-26434 |
In libxml2, there is a possible out of bounds read due to a buffer overflow
|
5.5
Medium
|
Sep 5, 2025 |
| CVE-2024-0028 |
In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing…
|
5.5
Medium
|
Sep 5, 2025 |
| CVE-2025-32322 |
In onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a malicious app a token…
|
7.8
High
|
Sep 4, 2025 |
| CVE-2025-26439 |
In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to…
|
7.8
High
|
Sep 4, 2025 |
| CVE-2025-26431 |
In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility…
|
7.8
High
|
Sep 4, 2025 |
| CVE-2025-26419 |
In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code
|
3.3
Low
|
Sep 4, 2025 |
| CVE-2024-40664 |
In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility…
|
6.2
Medium
|
Sep 4, 2025 |
| CVE-2025-22415 |
In android_app of Android.bp, there is a possible way to launch any activity as a system user
|
4.0
Medium
|
Sep 4, 2025 |