# Google Android.

Every CVE that names Google Android among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow.](https://agentprime.io/advisories/CVE-2023-35673.md)
  `CVE-2023-35673` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2023-35671.md)
  `CVE-2023-35671` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023 · Tags: Privilege escalation
- [Path traversal in Google Android](https://agentprime.io/advisories/CVE-2023-35670.md)
  `CVE-2023-35670` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 11 Sept 2023 · Tags: Path traversal
- [In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activities due to unsafe deserialization.](https://agentprime.io/advisories/CVE-2023-35669.md)
  `CVE-2023-35669` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2023-35667.md)
  `CVE-2023-35667` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023 · Tags: Privilege escalation
- [In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code.](https://agentprime.io/advisories/CVE-2023-35666.md)
  `CVE-2023-35666` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [In multiple files, there is a possible way to import a contact from another user due to a missing permission check.](https://agentprime.io/advisories/CVE-2023-35665.md)
  `CVE-2023-35665` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35664.md)
  `CVE-2023-35664` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free.](https://agentprime.io/advisories/CVE-2023-35658.md)
  `CVE-2023-35658` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [In registerServiceLocked of ManagedServices.java, there is a possible bypass of background activity launch restrictions due to an unsafe PendingIntent.](https://agentprime.io/advisories/CVE-2023-21229.md)
  `CVE-2023-21229` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broadcast about WiFi access point change and its BSSID or SSID due to a precondition…](https://agentprime.io/advisories/CVE-2023-21230.md)
  `CVE-2023-21230` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In getIntentForButton of ButtonManager.java, there is a possible way for an unprivileged application to start a non-exported or permission-protected activity due to a missing permission check.](https://agentprime.io/advisories/CVE-2023-21231.md)
  `CVE-2023-21231` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In multiple locations, there is a possible way to retrieve sensor data without permissions due to a permissions bypass.](https://agentprime.io/advisories/CVE-2023-21232.md)
  `CVE-2023-21232` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In multiple locations of avrc, there is a possible leak of heap data due to uninitialized data.](https://agentprime.io/advisories/CVE-2023-21233.md)
  `CVE-2023-21233` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check.](https://agentprime.io/advisories/CVE-2023-21234.md)
  `CVE-2023-21234` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In onCreate of LockSettingsActivity.java, there is a possible way set a new lockscreen PIN without entering the existing PIN due to a permissions bypass.](https://agentprime.io/advisories/CVE-2023-21235.md)
  `CVE-2023-21235` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value.](https://agentprime.io/advisories/CVE-2023-35689.md)
  `CVE-2023-35689` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In openContentUri of ActivityManagerService.java, there is a possible way for a third party app to obtain restricted files due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-21292.md)
  `CVE-2023-21292` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In update of MmsProvider.java, there is a possible way to bypass file permission checks due to a race condition.](https://agentprime.io/advisories/CVE-2023-21290.md)
  `CVE-2023-21290` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In multiple locations, there is a possible bypass of a multi user security boundary due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-21289.md)
  `CVE-2023-21289` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In visitUris of Notification.java, there is a possible way to reveal images across users due to a missing permission check.](https://agentprime.io/advisories/CVE-2023-21288.md)
  `CVE-2023-21288` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In multiple locations, there is a possible code execution due to type confusion.](https://agentprime.io/advisories/CVE-2023-21287.md)
  `CVE-2023-21287` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check.](https://agentprime.io/advisories/CVE-2023-21286.md)
  `CVE-2023-21286` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In setMetadata of MediaSessionRecord.java, there is a possible way to view another user's images due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-21285.md)
  `CVE-2023-21285` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In multiple functions of DevicePolicyManager.java, there is a possible way to prevent enabling the Find my Device feature due to improper input validation.](https://agentprime.io/advisories/CVE-2023-21284.md)
  `CVE-2023-21284` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In multiple functions of StatusHints.java, there is a possible way to reveal images across users due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-21283.md)
  `CVE-2023-21283` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In TRANSPOSER_SETTINGS of lpp_tran.h, there is a possible out of bounds write due to an incorrect bounds check.](https://agentprime.io/advisories/CVE-2023-21282.md)
  `CVE-2023-21282` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In multiple functions of KeyguardViewMediator.java, there is a possible failure to lock after screen timeout due to a logic error in the code.](https://agentprime.io/advisories/CVE-2023-21281.md)
  `CVE-2023-21281` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In setMediaButtonBroadcastReceiver of MediaSessionRecord.java, there is a possible permanent DoS due to resource exhaustion.](https://agentprime.io/advisories/CVE-2023-21280.md)
  `CVE-2023-21280` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In visitUris of RemoteViews.java, there is a possible cross-user media read due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-21279.md)
  `CVE-2023-21279` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In multiple locations, there is a possible way to obscure the microphone privacy indicator due to a logic error in the code.](https://agentprime.io/advisories/CVE-2023-21278.md)
  `CVE-2023-21278` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check.](https://agentprime.io/advisories/CVE-2023-21277.md)
  `CVE-2023-21277` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In writeToParcel of CursorWindow.cpp, there is a possible information disclosure due to uninitialized data.](https://agentprime.io/advisories/CVE-2023-21276.md)
  `CVE-2023-21276` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In decideCancelProvisioningDialog of AdminIntegratedFlowPrepareActivity.java, there is a possible way to bypass factory reset protections due to a logic error in the code.](https://agentprime.io/advisories/CVE-2023-21275.md)
  `CVE-2023-21275` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-21274.md)
  `CVE-2023-21274` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check.](https://agentprime.io/advisories/CVE-2023-21273.md)
  `CVE-2023-21273` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2023-21272.md)
  `CVE-2023-21272` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023 · Tags: Privilege escalation
- [In parseInputs of ShimPreparedModel.cpp, there is a possible out of bounds read due to improper input validation.](https://agentprime.io/advisories/CVE-2023-21271.md)
  `CVE-2023-21271` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into PiP mode from the background due to BAL bypass.](https://agentprime.io/advisories/CVE-2023-21269.md)
  `CVE-2023-21269` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023 · Tags: Privilege escalation
- [In update of MmsProvider.java, there is a possible way to change directory permissions due to a path traversal error.](https://agentprime.io/advisories/CVE-2023-21268.md)
  `CVE-2023-21268` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [Information disclosure in Google Android](https://agentprime.io/advisories/CVE-2023-21267.md)
  `CVE-2023-21267` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023 · Tags: Information disclosure
- [Improper certificate validation in Google Android](https://agentprime.io/advisories/CVE-2023-21265.md)
  `CVE-2023-21265` · CVE record: Google Android · CVSS 7.5 High · Not analysed yet · Published 14 Aug 2023 · Tags: Weak cryptography or TLS
- [In multiple functions of mem_protect.c, there is a possible way to access hypervisor memory due to a memory access check in the wrong place.](https://agentprime.io/advisories/CVE-2023-21264.md)
  `CVE-2023-21264` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to a logic error in the code.](https://agentprime.io/advisories/CVE-2023-21242.md)
  `CVE-2023-21242` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Aug 2023
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2023-21140.md)
  `CVE-2023-21140` · CVE record: Google Android · CVSS 6.8 Medium · Not analysed yet · Published 14 Aug 2023 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2023-21134.md)
  `CVE-2023-21134` · CVE record: Google Android · CVSS 6.8 Medium · Not analysed yet · Published 14 Aug 2023 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2023-21133.md)
  `CVE-2023-21133` · CVE record: Google Android · CVSS 6.8 Medium · Not analysed yet · Published 14 Aug 2023 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2023-21132.md)
  `CVE-2023-21132` · CVE record: Google Android · CVSS 6.8 Medium · Not analysed yet · Published 14 Aug 2023 · Tags: Broken access control
- [Insufficiently protected credentials in Google Android](https://agentprime.io/advisories/CVE-2023-20965.md)
  `CVE-2023-20965` · CVE record: Google Android · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Aug 2023 · Tags: Hard-coded credentials
- [In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an emergency call due to improper input validation.](https://agentprime.io/advisories/CVE-2023-35692.md)
  `CVE-2023-35692` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 14 Jul 2023 · Tags: CWE-273
- [In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and possibly contains mis-leading information to be a…](https://agentprime.io/advisories/CVE-2023-21260.md)
  `CVE-2023-21260` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 13 Jul 2023
- [In DMPixelLogger_ProcessDmCommand of DMPixelLogger.cpp, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35694.md)
  `CVE-2023-35694` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 12 Jul 2023
- [In incfs_kill_sb of fs/incfs/vfs.c, there is a possible memory corruption due to a use after free.](https://agentprime.io/advisories/CVE-2023-35693.md)
  `CVE-2023-35693` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 12 Jul 2023
- [there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35691.md)
  `CVE-2023-35691` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 12 Jul 2023
- [In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.](https://agentprime.io/advisories/CVE-2023-21400.md)
  `CVE-2023-21400` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 12 Jul 2023
- [there is a possible way to bypass cryptographic assurances due to a logic error in the code.](https://agentprime.io/advisories/CVE-2023-21399.md)
  `CVE-2023-21399` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 12 Jul 2023
- [In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy indicator due to a race condition.](https://agentprime.io/advisories/CVE-2023-21262.md)
  `CVE-2023-21262` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 12 Jul 2023
- [In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check.](https://agentprime.io/advisories/CVE-2023-21257.md)
  `CVE-2023-21257` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 12 Jul 2023
- [Incorrect authorization in Google Android](https://agentprime.io/advisories/CVE-2023-21256.md)
  `CVE-2023-21256` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 12 Jul 2023 · Tags: Broken access control
- [In multiple functions of binder.c, there is a possible memory corruption due to a use after free.](https://agentprime.io/advisories/CVE-2023-21255.md)
  `CVE-2023-21255` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 12 Jul 2023

Newest: <https://agentprime.io/advisories/technology/google-android.md>
Older: <https://agentprime.io/advisories/technology/google-android.md?cursor=WyIyMDIzLTA3LTEyVDIzOjMzOjAwLjI0NDAwMFoiLCJDVkUtMjAyMy0yMTI1NSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=google-android&cursor=WyIyMDIzLTA5LTExVDIwOjA5OjUzLjU4MDAwMFoiLCJDVkUtMjAyMy0zNTY3NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/google-android/?cursor=WyIyMDIzLTA5LTExVDIwOjA5OjUzLjU4MDAwMFoiLCJDVkUtMjAyMy0zNTY3NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.