Advisories · Technology

Google Android.

Every CVE that names Google Android among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-28671 CVE record

CVSS 3.3 Low

Time-of-check time-of-use race condition in Google Android
- Google Android
- Race condition
Not analysed yet 8 Sept 2026
CVE-2026-28668 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28666 CVE record

CVSS 8.8 High

Incorrect authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-28664 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28663 CVE record

CVSS 7.8 High

Incorrect authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-28662 CVE record

CVSS 8.0 High

Out-of-bounds write in Google Android
- Google Android
- Memory corruption
Not analysed yet 8 Sept 2026
CVE-2026-28660 CVE record

CVSS 3.3 Low

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28658 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28657 CVE record

CVSS 7.8 High

In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Sept 2026
CVE-2026-28656 CVE record

CVSS 7.3 High

Clickjacking in Google Android
- Google Android
- CWE-1021
Not analysed yet 8 Sept 2026
CVE-2026-28655 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28653 CVE record

CVSS 7.8 High

Out-of-bounds write in Google Android
- Google Android
- Memory corruption
- CWE-1190
Not analysed yet 8 Sept 2026
CVE-2026-28652 CVE record

CVSS 3.1 Low

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-28650 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28644 CVE record

CVSS 7.8 High

In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible permission bypass due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Sept 2026
CVE-2026-28642 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28639 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28638 CVE record

CVSS 3.3 Low

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 8 Sept 2026
CVE-2026-28636 CVE record

CVSS 7.8 High

In setupLayout of PickActivity.java, there is a possible bypass of the "Install unknown apps" security restriction due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Sept 2026
CVE-2026-28634 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28633 CVE record

CVSS 5.5 Medium

Resource allocation without limits in Google Android
- Google Android
- Denial of service
Not analysed yet 8 Sept 2026
CVE-2026-28631 CVE record

CVSS 7.8 High

Open redirect in Google Android
- Google Android
- Open redirect
Not analysed yet 8 Sept 2026
CVE-2026-28630 CVE record

CVSS 3.3 Low

Open redirect in Google Android
- Google Android
- Open redirect
Not analysed yet 8 Sept 2026
CVE-2026-28627 CVE record

CVSS 4.3 Medium

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28626 CVE record

CVSS 7.3 High

Open redirect in Google Android
- Google Android
- Open redirect
Not analysed yet 8 Sept 2026
CVE-2026-28624 CVE record

CVSS 7.8 High

In multiple locations, there is a possible read/write access to files without the proper permissions due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Sept 2026
CVE-2026-28623 CVE record

CVSS 3.3 Low

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-28622 CVE record

CVSS 3.3 Low

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-28620 CVE record

CVSS 7.8 High

Incorrect authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-28618 CVE record

CVSS 8.8 High

Out-of-bounds write in Google Android
- Google Android
- Memory corruption
Not analysed yet 8 Sept 2026
CVE-2026-28617 CVE record

CVSS 5.5 Medium

Uncontrolled resource consumption in Google Android
- Google Android
- Denial of service
Not analysed yet 8 Sept 2026
CVE-2026-28616 CVE record

CVSS 7.8 High

In Setup Wizard, there is a possible way to force connection to a malicious network due to confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Sept 2026
CVE-2026-28614 CVE record

CVSS 7.8 High

In onCreate of SlicePermissionActivity.java, there is a possible permission bypass due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Sept 2026
CVE-2026-28613 CVE record

CVSS 7.3 High

Improper input validation in Google Android
- Google Android
- CWE-20
Not analysed yet 8 Sept 2026
CVE-2026-28612 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28611 CVE record

CVSS 7.8 High

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-28609 CVE record

CVSS 8.8 High

Incorrect type conversion in Google Android
- Google Android
- CWE-704
Not analysed yet 8 Sept 2026
CVE-2026-28607 CVE record

CVSS 7.8 High

In multiple functions in multiple locations, there is a possible background activity launch bypass due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Sept 2026
CVE-2026-28606 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Improper authentication in Google Android
- Google Android
- Authentication bypass
Not analysed yet 8 Sept 2026
CVE-2026-28604 CVE record

CVSS 7.5 High

Race condition in Google Android
- Google Android
- Race condition
Not analysed yet 8 Sept 2026
CVE-2026-28603 CVE record

CVSS 7.8 High

In assertSafeToStartCustomActivity of AppRestrictionsFragment.java, there is a possible read/write access to private files due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Sept 2026
CVE-2026-28602 CVE record

CVSS 7.8 High

Improper access control in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-28600 CVE record

CVSS 7.8 High

In onCreate of PaymentDefaultDialog.java, there is a possible way to change default payment app due to a confused deputy.
- Google Android
- CWE-441
Not analysed yet 8 Sept 2026
CVE-2026-28599 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28596 CVE record

CVSS 5.5 Medium

Uncontrolled resource consumption in Google Android
- Google Android
- Denial of service
Not analysed yet 8 Sept 2026
CVE-2026-28594 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28593 CVE record

CVSS 7.8 High

In getItemList of SettingsFragment.java, there is a possible user interaction bypass due to misleading or insufficient UI.
- Google Android
- CWE-356
Not analysed yet 8 Sept 2026
CVE-2026-28590 CVE record

CVSS 7.8 High

Improper signature verification in Google Android
- Google Android
- Weak cryptography or TLS
Not analysed yet 8 Sept 2026
CVE-2026-28584 CVE record

CVSS 5.5 Medium

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28583 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- Memory corruption
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-28582 CVE record

CVSS 3.3 Low

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2026-28572 CVE record

CVSS 7.8 High

Open redirect in Google Android
- Google Android
- Open redirect
Not analysed yet 8 Sept 2026
CVE-2026-0084 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-0065 CVE record

CVSS 7.8 High

Protection mechanism failure in Google Android
- Google Android
- CWE-693
Not analysed yet 8 Sept 2026
CVE-2026-0054 CVE record

CVSS 3.3 Low

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 8 Sept 2026
CVE-2025-36940 CVE record

CVSS 8.8 High

Use after free in Google Android
- Google Android
- Memory corruption
Not analysed yet 24 Aug 2026
CVE-2026-0163 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Use after free in Google Android
- Google Android
- Memory corruption
Not analysed yet 4 Aug 2026
CVE-2026-28573 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 18 Jun 2026
CVE-2026-0063 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Improper privilege management in Google Android
- Google Android
- Privilege escalation
Not analysed yet 17 Jun 2026
CVE-2026-28587 CVE record

CVSS 10.0 CriticalCritical · CVSS 9+

Missing authorization in Google Android
- Google Android
- Broken access control
Not analysed yet 17 Jun 2026