# Google Android. Every CVE that names Google Android among its affected products, newest first. Vendors and products are as the CNA wrote them. ## Records, newest first (an older page) - [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2025-48612.md) `CVE-2025-48612` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-20 - [In \_\_pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code.](https://agentprime.io/advisories/CVE-2025-48610.md) `CVE-2025-48610` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2025 - [In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code.](https://agentprime.io/advisories/CVE-2025-48607.md) `CVE-2025-48607` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2025 - [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2025-48604.md) `CVE-2025-48604` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Broken access control - [Uncontrolled resource consumption in Google Android](https://agentprime.io/advisories/CVE-2025-48603.md) `CVE-2025-48603` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Denial of service - [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2025-48601.md) `CVE-2025-48601` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-20 - [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2025-48600.md) `CVE-2025-48600` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Broken access control - [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2025-48599.md) `CVE-2025-48599` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: Broken access control - [In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy.](https://agentprime.io/advisories/CVE-2025-48598.md) `CVE-2025-48598` · CVE record: Google Android · CVSS 6.6 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-441 - [Clickjacking in Google Android](https://agentprime.io/advisories/CVE-2025-48597.md) `CVE-2025-48597` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-1021 - [Out-of-bounds read in Google Android](https://agentprime.io/advisories/CVE-2025-48596.md) `CVE-2025-48596` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: Memory corruption - [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2025-48594.md) `CVE-2025-48594` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-20 - [Heap-based buffer overflow in Google Android](https://agentprime.io/advisories/CVE-2025-48592.md) `CVE-2025-48592` · CVE record: Google Android · CVSS 6.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Memory corruption - [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2025-48591.md) `CVE-2025-48591` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Broken access control - [Uncontrolled resource consumption in Google Android](https://agentprime.io/advisories/CVE-2025-48590.md) `CVE-2025-48590` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Denial of service - [In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code.](https://agentprime.io/advisories/CVE-2025-48589.md) `CVE-2025-48589` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 - [In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code.](https://agentprime.io/advisories/CVE-2025-48588.md) `CVE-2025-48588` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 - [In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy.](https://agentprime.io/advisories/CVE-2025-48586.md) `CVE-2025-48586` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-441 - [Uncontrolled resource consumption in Google Android](https://agentprime.io/advisories/CVE-2025-48584.md) `CVE-2025-48584` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Denial of service - [In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code.](https://agentprime.io/advisories/CVE-2025-48583.md) `CVE-2025-48583` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 - [In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code.](https://agentprime.io/advisories/CVE-2025-48580.md) `CVE-2025-48580` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 - [Uncontrolled resource consumption in Google Android](https://agentprime.io/advisories/CVE-2025-48576.md) `CVE-2025-48576` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Denial of service - [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2025-48575.md) `CVE-2025-48575` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: Broken access control - [Execution with unnecessary privileges in Google Android](https://agentprime.io/advisories/CVE-2025-48573.md) `CVE-2025-48573` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: Privilege escalation - [Missing authentication in Google Android](https://agentprime.io/advisories/CVE-2025-48572.md) `CVE-2025-48572` · CVE record: Google Android · CVSS 7.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 8 Dec 2025 · Tags: Authentication bypass - [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2025-48566.md) `CVE-2025-48566` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-20 - [In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code.](https://agentprime.io/advisories/CVE-2025-48565.md) `CVE-2025-48565` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 - [Race condition in Google Android](https://agentprime.io/advisories/CVE-2025-48564.md) `CVE-2025-48564` · CVE record: Google Android · CVSS 7.0 High · Not analysed yet · Published 8 Dec 2025 · Tags: Race condition - [In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy.](https://agentprime.io/advisories/CVE-2025-48555.md) `CVE-2025-48555` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-441 - [In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused deputy.](https://agentprime.io/advisories/CVE-2025-48536.md) `CVE-2025-48536` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-441 - [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2025-48525.md) `CVE-2025-48525` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-20 - [In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code.](https://agentprime.io/advisories/CVE-2025-32329.md) `CVE-2025-32329` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 - [In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code.](https://agentprime.io/advisories/CVE-2025-32328.md) `CVE-2025-32328` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 - [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2025-32319.md) `CVE-2025-32319` · CVE record: Google Android · CVSS 6.7 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: Broken access control - [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2025-22432.md) `CVE-2025-22432` · CVE record: Google Android · CVSS 6.7 Medium · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-20 - [In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy.](https://agentprime.io/advisories/CVE-2025-22420.md) `CVE-2025-22420` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 8 Dec 2025 · Tags: CWE-441 - [Use after free in Google Android](https://agentprime.io/advisories/CVE-2025-48593.md) `CVE-2025-48593` · CVE record: Google Android · CVSS 8.0 High · Not analysed yet · Published 18 Nov 2025 · Tags: Memory corruption - [In System UI, there is a possible way to view other users' images due to a confused deputy.](https://agentprime.io/advisories/CVE-2025-32320.md) `CVE-2025-32320` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-441 - [Heap-based buffer overflow in Google Android](https://agentprime.io/advisories/CVE-2025-32318.md) `CVE-2025-32318` · CVE record: Google Android · CVSS 8.8 High · Not analysed yet · Published 5 Sept 2025 · Tags: Memory corruption - [In App Widget, there is a possible Information Disclosure due to a confused deputy.](https://agentprime.io/advisories/CVE-2025-32317.md) `CVE-2025-32317` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-441 - [Out-of-bounds write in Google Android](https://agentprime.io/advisories/CVE-2025-32316.md) `CVE-2025-32316` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Memory corruption - [In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to close the app due to a logic error in the code.](https://agentprime.io/advisories/CVE-2025-26461.md) `CVE-2025-26461` · CVE record: Google Android · CVSS 3.3 Low · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-703 - [Buffer overflow in Google Android](https://agentprime.io/advisories/CVE-2025-26434.md) `CVE-2025-26434` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Memory corruption - [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2024-0028.md) `CVE-2024-0028` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 5 Sept 2025 · Tags: Broken access control - [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2025-32322.md) `CVE-2025-32322` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-20 - [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2025-26439.md) `CVE-2025-26439` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-693 - [Protection mechanism failure in Google Android](https://agentprime.io/advisories/CVE-2025-26431.md) `CVE-2025-26431` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-693 - [Authentication bypass by spoofing in Google Android](https://agentprime.io/advisories/CVE-2025-26419.md) `CVE-2025-26419` · CVE record: Google Android · CVSS 3.3 Low · Not analysed yet · Published 4 Sept 2025 · Tags: Authentication bypass - [Uncontrolled resource consumption in Google Android](https://agentprime.io/advisories/CVE-2024-40664.md) `CVE-2024-40664` · CVE record: Google Android · CVSS 6.2 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: Denial of service - [In android_app of Android.bp, there is a possible way to launch any activity as a system user.](https://agentprime.io/advisories/CVE-2025-22415.md) `CVE-2025-22415` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: Privilege escalation - [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2025-22414.md) `CVE-2025-22414` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2025 · Tags: Broken access control - [In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to a logic error in the code.](https://agentprime.io/advisories/CVE-2024-49731.md) `CVE-2024-49731` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: Privilege escalation - [Improper check for unusual conditions in Google Android](https://agentprime.io/advisories/CVE-2025-48581.md) `CVE-2025-48581` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-754 - [In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value.](https://agentprime.io/advisories/CVE-2025-48563.md) `CVE-2025-48563` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-453 - [Sensitive information in error messages in Google Android](https://agentprime.io/advisories/CVE-2025-48562.md) `CVE-2025-48562` · CVE record: Google Android · CVSS 5.0 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: Information disclosure - [Observable discrepancy in Google Android](https://agentprime.io/advisories/CVE-2025-48561.md) `CVE-2025-48561` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: Information disclosure - [Google Android: In AndroidManifest.xml, there is a possible way for an app to monitor motion events due…](https://agentprime.io/advisories/CVE-2025-48560.md) `CVE-2025-48560` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-441 - [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2025-48559.md) `CVE-2025-48559` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-20 - [In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking.](https://agentprime.io/advisories/CVE-2025-48558.md) `CVE-2025-48558` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-927 - [Improper input validation in Google Android](https://agentprime.io/advisories/CVE-2025-48556.md) `CVE-2025-48556` · CVE record: Google Android · CVSS 7.3 High · Not analysed yet · Published 4 Sept 2025 · Tags: CWE-20 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .