# Google Android.

Every CVE that names Google Android among its affected products, newest first. Vendors and products are as the CNA wrote them.

## Records, newest first (an older page)

- [In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass.](https://agentprime.io/advisories/CVE-2023-21297.md)
  `CVE-2023-21297` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 30 Oct 2023
- [In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.](https://agentprime.io/advisories/CVE-2023-21296.md)
  `CVE-2023-21296` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 30 Oct 2023
- [In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check.](https://agentprime.io/advisories/CVE-2023-21295.md)
  `CVE-2023-21295` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 30 Oct 2023
- [In Slice, there is a possible disclosure of installed packages due to a missing permission check.](https://agentprime.io/advisories/CVE-2023-21294.md)
  `CVE-2023-21294` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 30 Oct 2023
- [In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.](https://agentprime.io/advisories/CVE-2023-21293.md)
  `CVE-2023-21293` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 30 Oct 2023
- [In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.](https://agentprime.io/advisories/CVE-2022-20531.md)
  `CVE-2022-20531` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 30 Oct 2023
- [Observable discrepancy in Google Android](https://agentprime.io/advisories/CVE-2022-20264.md)
  `CVE-2022-20264` · CVE record: Google Android · CVSS 5.5 Medium · Not analysed yet · Published 30 Oct 2023 · Tags: Information disclosure
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2021-39810.md)
  `CVE-2021-39810` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 30 Oct 2023 · Tags: Broken access control
- [Use after free in Google Android](https://agentprime.io/advisories/CVE-2023-40140.md)
  `CVE-2023-40140` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2023 · Tags: Memory corruption
- [In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-40139.md)
  `CVE-2023-40139` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-40138.md)
  `CVE-2023-40138` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-40137.md)
  `CVE-2023-40137` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-40136.md)
  `CVE-2023-40136` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-40135.md)
  `CVE-2023-40135` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-40134.md)
  `CVE-2023-40134` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-40133.md)
  `CVE-2023-40133` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [Use after free in Google Android](https://agentprime.io/advisories/CVE-2023-40131.md)
  `CVE-2023-40131` · CVE record: Google Android · CVSS 7.0 High · Not analysed yet · Published 27 Oct 2023 · Tags: Memory corruption
- [In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code.](https://agentprime.io/advisories/CVE-2023-40130.md)
  `CVE-2023-40130` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2023
- [In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow.](https://agentprime.io/advisories/CVE-2023-40129.md)
  `CVE-2023-40129` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow.](https://agentprime.io/advisories/CVE-2023-40128.md)
  `CVE-2023-40128` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In multiple locations, there is a possible way to access screenshots due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-40127.md)
  `CVE-2023-40127` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass.](https://agentprime.io/advisories/CVE-2023-40125.md)
  `CVE-2023-40125` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2023
- [In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-40123.md)
  `CVE-2023-40123` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization.](https://agentprime.io/advisories/CVE-2023-40121.md)
  `CVE-2023-40121` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 27 Oct 2023
- [In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation.](https://agentprime.io/advisories/CVE-2023-40120.md)
  `CVE-2023-40120` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2023
- [Incorrect authorization in Google Android](https://agentprime.io/advisories/CVE-2023-40117.md)
  `CVE-2023-40117` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2023 · Tags: Broken access control
- [In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code.](https://agentprime.io/advisories/CVE-2023-40116.md)
  `CVE-2023-40116` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2023
- [In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35663.md)
  `CVE-2023-35663` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 18 Oct 2023
- [In multiple functions of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35656.md)
  `CVE-2023-35656` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 18 Oct 2023
- [there is a possible use-after-free write due to improper locking.](https://agentprime.io/advisories/CVE-2023-3781.md)
  `CVE-2023-3781` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In TBD of TBD, there is a possible way to bypass carrier restrictions due to a logic error in the code.](https://agentprime.io/advisories/CVE-2023-40142.md)
  `CVE-2023-40142` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In temp_residency_name_store of thermal_metrics.c, there is a possible out of bounds write due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-40141.md)
  `CVE-2023-40141` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [there is a possible out of bounds write due to buffer overflow.](https://agentprime.io/advisories/CVE-2023-35662.md)
  `CVE-2023-35662` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In ProfSixDecomTcpSACKoption of RohcPacketCommon.cpp, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35661.md)
  `CVE-2023-35661` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In lwis_transaction_client_cleanup of lwis_transaction.c, there is a possible way to corrupt memory due to a use after free.](https://agentprime.io/advisories/CVE-2023-35660.md)
  `CVE-2023-35660` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In CanConvertPadV2Op of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds read due to a heap buffer overflow.](https://agentprime.io/advisories/CVE-2023-35655.md)
  `CVE-2023-35655` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In ctrl_roi of stmvl53l1_module.c, there is a possible out of bounds read due to an incorrect bounds check.](https://agentprime.io/advisories/CVE-2023-35654.md)
  `CVE-2023-35654` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In TBD of TBD, there is a possible way to access location information due to a permissions bypass.](https://agentprime.io/advisories/CVE-2023-35653.md)
  `CVE-2023-35653` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In ProtocolEmergencyCallListIndAdapter::Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35652.md)
  `CVE-2023-35652` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In several functions of Exynos modem files, there is a possible out of bounds write due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35649.md)
  `CVE-2023-35649` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35648.md)
  `CVE-2023-35648` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35647.md)
  `CVE-2023-35647` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In TBD of TBD, there is a possible stack buffer overflow due to a missing bounds check.](https://agentprime.io/advisories/CVE-2023-35646.md)
  `CVE-2023-35646` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In tbd of tbd, there is a possible memory corruption due to a race condition.](https://agentprime.io/advisories/CVE-2023-35645.md)
  `CVE-2023-35645` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Oct 2023
- [In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing permission check.](https://agentprime.io/advisories/CVE-2023-21291.md)
  `CVE-2023-21291` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 6 Oct 2023
- [In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass.](https://agentprime.io/advisories/CVE-2023-21266.md)
  `CVE-2023-21266` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 6 Oct 2023
- [In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion.](https://agentprime.io/advisories/CVE-2023-21253.md)
  `CVE-2023-21253` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 6 Oct 2023
- [In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to improper input validation.](https://agentprime.io/advisories/CVE-2023-21252.md)
  `CVE-2023-21252` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 6 Oct 2023
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2023-21244.md)
  `CVE-2023-21244` · CVE record: Google Android · CVSS 6.7 Medium · Not analysed yet · Published 6 Oct 2023 · Tags: Broken access control
- [In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free.](https://agentprime.io/advisories/CVE-2023-35687.md)
  `CVE-2023-35687` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow.](https://agentprime.io/advisories/CVE-2023-35684.md)
  `CVE-2023-35684` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection.](https://agentprime.io/advisories/CVE-2023-35683.md)
  `CVE-2023-35683` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy.](https://agentprime.io/advisories/CVE-2023-35682.md)
  `CVE-2023-35682` · CVE record: Google Android · CVSS 7.8 High · Not analysed yet · Published 11 Sept 2023
- [In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow.](https://agentprime.io/advisories/CVE-2023-35681.md)
  `CVE-2023-35681` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [Unsafe reflection in Google Android](https://agentprime.io/advisories/CVE-2023-35680.md)
  `CVE-2023-35680` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023 · Tags: Code injection
- [In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data.](https://agentprime.io/advisories/CVE-2023-35679.md)
  `CVE-2023-35679` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2023-35677.md)
  `CVE-2023-35677` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023 · Tags: Broken access control
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2023-35676.md)
  `CVE-2023-35676` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023 · Tags: Privilege escalation
- [In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files played by another user on the same device due to a logic error in the code.](https://agentprime.io/advisories/CVE-2023-35675.md)
  `CVE-2023-35675` · CVE record: Google Android · No CVSS score · Not analysed yet · Published 11 Sept 2023
- [Improper privilege management in Google Android](https://agentprime.io/advisories/CVE-2023-35674.md)
  `CVE-2023-35674` · CVE record: Google Android · CVSS 8.8 High · Critical (KEV) · In CISA KEV · Not analysed yet · Published 11 Sept 2023 · Tags: Privilege escalation

Newest: <https://agentprime.io/advisories/technology/google-android.md>
Older: <https://agentprime.io/advisories/technology/google-android.md?cursor=WyIyMDIzLTA5LTExVDIwOjA5OjUzLjU4MDAwMFoiLCJDVkUtMjAyMy0zNTY3NCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?technology=google-android&cursor=WyIyMDIzLTEwLTMwVDE2OjU2OjI2Ljk0NzAwMFoiLCJDVkUtMjAyMy0yMTI5OCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/technology/google-android/?cursor=WyIyMDIzLTEwLTMwVDE2OjU2OjI2Ljk0NzAwMFoiLCJDVkUtMjAyMy0yMTI5OCJd>. Everything for agents: <https://agentprime.io/llms.txt>.