Advisories · Technology

Google Android.

Every CVE that names Google Android among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2025-48612 CVE record

CVSS 7.8 High

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 8 Dec 2025
CVE-2025-48610 CVE record

CVSS 5.5 Medium

In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible configuration data leak due to a logic error in the code.
- Google Android
Not analysed yet 8 Dec 2025
CVE-2025-48607 CVE record

CVSS 5.5 Medium

In multiple locations, there is a possible way to create a large amount of app ops due to a logic error in the code.
- Google Android
Not analysed yet 8 Dec 2025
CVE-2025-48604 CVE record

CVSS 5.5 Medium

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Dec 2025
CVE-2025-48603 CVE record

CVSS 5.5 Medium

Uncontrolled resource consumption in Google Android
- Google Android
- Denial of service
Not analysed yet 8 Dec 2025
CVE-2025-48601 CVE record

CVSS 5.5 Medium

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 8 Dec 2025
CVE-2025-48600 CVE record

CVSS 5.5 Medium

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Dec 2025
CVE-2025-48599 CVE record

CVSS 7.8 High

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Dec 2025
CVE-2025-48598 CVE record

CVSS 6.6 Medium

In multiple locations, there is a possible way to alter the primary user's face unlock settings due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Dec 2025
CVE-2025-48597 CVE record

CVSS 7.8 High

Clickjacking in Google Android
- Google Android
- CWE-1021
Not analysed yet 8 Dec 2025
CVE-2025-48596 CVE record

CVSS 7.8 High

Out-of-bounds read in Google Android
- Google Android
- Memory corruption
Not analysed yet 8 Dec 2025
CVE-2025-48594 CVE record

CVSS 7.8 High

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 8 Dec 2025
CVE-2025-48592 CVE record

CVSS 6.5 Medium

Heap-based buffer overflow in Google Android
- Google Android
- Memory corruption
Not analysed yet 8 Dec 2025
CVE-2025-48591 CVE record

CVSS 5.5 Medium

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Dec 2025
CVE-2025-48590 CVE record

CVSS 5.5 Medium

Uncontrolled resource consumption in Google Android
- Google Android
- Denial of service
Not analysed yet 8 Dec 2025
CVE-2025-48589 CVE record

CVSS 7.8 High

In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code.
- Google Android
Not analysed yet 8 Dec 2025
CVE-2025-48588 CVE record

CVSS 7.8 High

In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code.
- Google Android
Not analysed yet 8 Dec 2025
CVE-2025-48586 CVE record

CVSS 7.8 High

In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Dec 2025
CVE-2025-48584 CVE record

CVSS 5.5 Medium

Uncontrolled resource consumption in Google Android
- Google Android
- Denial of service
Not analysed yet 8 Dec 2025
CVE-2025-48583 CVE record

CVSS 7.8 High

In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code.
- Google Android
Not analysed yet 8 Dec 2025
CVE-2025-48580 CVE record

CVSS 7.8 High

In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code.
- Google Android
Not analysed yet 8 Dec 2025
CVE-2025-48576 CVE record

CVSS 5.5 Medium

Uncontrolled resource consumption in Google Android
- Google Android
- Denial of service
Not analysed yet 8 Dec 2025
CVE-2025-48575 CVE record

CVSS 7.8 High

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Dec 2025
CVE-2025-48573 CVE record

CVSS 7.8 High

Execution with unnecessary privileges in Google Android
- Google Android
- Privilege escalation
Not analysed yet 8 Dec 2025
CVE-2025-48572 CVE record

CVSS 7.8 HighCritical · KEVKEV

Missing authentication in Google Android
- Google Android
- Authentication bypass
Not analysed yet 8 Dec 2025
CVE-2025-48566 CVE record

CVSS 7.8 High

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 8 Dec 2025
CVE-2025-48565 CVE record

CVSS 7.8 High

In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code.
- Google Android
Not analysed yet 8 Dec 2025
CVE-2025-48564 CVE record

CVSS 7.0 High

Race condition in Google Android
- Google Android
- Race condition
Not analysed yet 8 Dec 2025
CVE-2025-48555 CVE record

CVSS 7.8 High

In multiple functions of NotificationStation.java, there is a possible cross-profile information disclosure due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Dec 2025
CVE-2025-48536 CVE record

CVSS 7.8 High

In grantAllowlistedPackagePermissions of SettingsSliceProvider.java, there is a possible way for a third party app to modify secure settings due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Dec 2025
CVE-2025-48525 CVE record

CVSS 7.8 High

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 8 Dec 2025
CVE-2025-32329 CVE record

CVSS 7.8 High

In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code.
- Google Android
Not analysed yet 8 Dec 2025
CVE-2025-32328 CVE record

CVSS 7.8 High

In multiple functions of Session.java, there is a possible way to view images belonging to a different user of the device due to a logic error in the code.
- Google Android
Not analysed yet 8 Dec 2025
CVE-2025-32319 CVE record

CVSS 6.7 Medium

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Dec 2025
CVE-2025-22432 CVE record

CVSS 6.7 Medium

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 8 Dec 2025
CVE-2025-22420 CVE record

CVSS 7.8 High

In multiple locations, there is a possible way to leak audio files across user profiles due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Dec 2025
CVE-2025-48593 CVE record

CVSS 8.0 High

Use after free in Google Android
- Google Android
- Memory corruption
Not analysed yet 18 Nov 2025
CVE-2025-32320 CVE record

CVSS 7.8 High

In System UI, there is a possible way to view other users' images due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 5 Sept 2025
CVE-2025-32318 CVE record

CVSS 8.8 High

Heap-based buffer overflow in Google Android
- Google Android
- Memory corruption
Not analysed yet 5 Sept 2025
CVE-2025-32317 CVE record

CVSS 5.5 Medium

In App Widget, there is a possible Information Disclosure due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 5 Sept 2025
CVE-2025-32316 CVE record

CVSS 5.5 Medium

Out-of-bounds write in Google Android
- Google Android
- Memory corruption
Not analysed yet 5 Sept 2025
CVE-2025-26461 CVE record

CVSS 3.3 Low

In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to close the app due to a logic error in the code.
- Google Android
- CWE-703
Not analysed yet 5 Sept 2025
CVE-2025-26434 CVE record

CVSS 5.5 Medium

Buffer overflow in Google Android
- Google Android
- Memory corruption
Not analysed yet 5 Sept 2025
CVE-2024-0028 CVE record

CVSS 5.5 Medium

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 5 Sept 2025
CVE-2025-32322 CVE record

CVSS 7.8 High

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 4 Sept 2025
CVE-2025-26439 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 4 Sept 2025
CVE-2025-26431 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 4 Sept 2025
CVE-2025-26419 CVE record

CVSS 3.3 Low

Authentication bypass by spoofing in Google Android
- Google Android
- Authentication bypass
Not analysed yet 4 Sept 2025
CVE-2024-40664 CVE record

CVSS 6.2 Medium

Uncontrolled resource consumption in Google Android
- Google Android
- Denial of service
Not analysed yet 4 Sept 2025
CVE-2025-22415 CVE record

CVSS 4.0 Medium

In android_app of Android.bp, there is a possible way to launch any activity as a system user.
- Google Android
- Privilege escalation
Not analysed yet 4 Sept 2025
CVE-2025-22414 CVE record

CVSS 7.8 High

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 4 Sept 2025
CVE-2024-49731 CVE record

CVSS 4.0 Medium

In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to a logic error in the code.
- Google Android
- Privilege escalation
Not analysed yet 4 Sept 2025
CVE-2025-48581 CVE record

CVSS 8.4 High

Improper check for unusual conditions in Google Android
- Google Android
- CWE-754
Not analysed yet 4 Sept 2025
CVE-2025-48563 CVE record

CVSS 7.8 High

In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value.
- Google Android
- CWE-453
Not analysed yet 4 Sept 2025
CVE-2025-48562 CVE record

CVSS 5.0 Medium

Sensitive information in error messages in Google Android
- Google Android
- Information disclosure
Not analysed yet 4 Sept 2025
CVE-2025-48561 CVE record

CVSS 5.5 Medium

Observable discrepancy in Google Android
- Google Android
- Information disclosure
Not analysed yet 4 Sept 2025
CVE-2025-48560 CVE record

CVSS 5.5 Medium

Google Android: In AndroidManifest.xml, there is a possible way for an app to monitor motion events due…
- Google Android
- CWE-441
Not analysed yet 4 Sept 2025
CVE-2025-48559 CVE record

CVSS 5.5 Medium

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 4 Sept 2025
CVE-2025-48558 CVE record

CVSS 7.8 High

In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit intent hijacking.
- Google Android
- CWE-927
Not analysed yet 4 Sept 2025
CVE-2025-48556 CVE record

CVSS 7.3 High

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 4 Sept 2025