| CVE-2026-0006 |
In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow
|
9.8
Critique
|
2 mars 2026 |
| CVE-2026-0005 |
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing…
|
6.2
Moyenne
|
2 mars 2026 |
| CVE-2025-48654 |
In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code
|
7.8
Élevée
|
2 mars 2026 |
| CVE-2025-48653 |
In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in…
|
8.4
Élevée
|
2 mars 2026 |
| CVE-2025-48650 |
In multiple locations, there is a possible information disclosure due to SQL injection
|
8.4
Élevée
|
2 mars 2026 |
| CVE-2025-48646 |
In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy
|
7.8
Élevée
|
2 mars 2026 |
| CVE-2025-48645 |
In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation
|
9.8
Critique
|
2 mars 2026 |
| CVE-2025-48644 |
In multiple locations, there is a possible persistent denial of service due to improper input validation
|
5.5
Moyenne
|
2 mars 2026 |
| CVE-2025-48642 |
In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code
|
5.5
Moyenne
|
2 mars 2026 |
| CVE-2025-48641 |
In multiple functions of Nfc.h, there is a possible use after free due to a race condition
|
7.0
Élevée
|
2 mars 2026 |
| CVE-2025-48635 |
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic…
|
7.7
Élevée
|
2 mars 2026 |
| CVE-2025-48634 |
In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check
|
8.4
Élevée
|
2 mars 2026 |
| CVE-2025-48630 |
In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel…
|
7.4
Élevée
|
2 mars 2026 |
| CVE-2025-48619 |
In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate…
|
8.4
Élevée
|
2 mars 2026 |
| CVE-2025-48613 |
In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was…
|
7.8
Élevée
|
2 mars 2026 |
| CVE-2025-48609 |
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony,…
|
9.1
Critique
|
2 mars 2026 |
| CVE-2025-48605 |
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the…
|
8.4
Élevée
|
2 mars 2026 |
| CVE-2025-48602 |
In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass…
|
8.4
Élevée
|
2 mars 2026 |
| CVE-2025-48587 |
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input…
|
6.2
Moyenne
|
2 mars 2026 |
| CVE-2025-48585 |
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input…
|
6.2
Moyenne
|
2 mars 2026 |
| CVE-2025-48582 |
In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to…
|
8.4
Élevée
|
2 mars 2026 |
| CVE-2025-48579 |
In multiple functions of MediaProvider.java, there is a possible external storage write permission bypass due to a…
|
8.4
Élevée
|
2 mars 2026 |
| CVE-2025-48578 |
In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due…
|
7.8
Élevée
|
2 mars 2026 |
| CVE-2025-48577 |
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a race condition
|
7.4
Élevée
|
2 mars 2026 |
| CVE-2025-48574 |
In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events…
|
8.4
Élevée
|
2 mars 2026 |