Google Android.

In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to an integer overflow.

• Google Android

Improper privilege management in Google Android

• Google Android
• Privilege escalation

Path traversal in Google Android

• Google Android
• Path traversal

In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to control other running activities due to unsafe deserialization.

• Google Android

Improper privilege management in Google Android

• Google Android
• Privilege escalation

In bta_av_rc_msg of bta_av_act.cc, there is a possible use after free due to a logic error in the code.

• Google Android

In multiple files, there is a possible way to import a contact from another user due to a missing permission check.

• Google Android

In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In gatt_process_prep_write_rsp of gatt_cl.cc, there is a possible privilege escalation due to a use after free.

• Google Android

In registerServiceLocked of ManagedServices.java, there is a possible bypass of background activity launch restrictions due to an unsafe PendingIntent.

• Google Android

In onAccessPointChanged of AccessPointPreference.java, there is a possible way for unprivileged apps to receive a broadcast about WiFi access point change and its BSSID or SSID due to a precondition…

• Google Android

In getIntentForButton of ButtonManager.java, there is a possible way for an unprivileged application to start a non-exported or permission-protected activity due to a missing permission check.

• Google Android

In multiple locations, there is a possible way to retrieve sensor data without permissions due to a permissions bypass.

• Google Android

In multiple locations of avrc, there is a possible leak of heap data due to uninitialized data.

• Google Android

In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check.

• Google Android

In onCreate of LockSettingsActivity.java, there is a possible way set a new lockscreen PIN without entering the existing PIN due to a permissions bypass.

• Google Android

In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW completion due to an insecure default value.

• Google Android

In openContentUri of ActivityManagerService.java, there is a possible way for a third party app to obtain restricted files due to a confused deputy.

• Google Android

In update of MmsProvider.java, there is a possible way to bypass file permission checks due to a race condition.

• Google Android

In multiple locations, there is a possible bypass of a multi user security boundary due to a confused deputy.

• Google Android

In visitUris of Notification.java, there is a possible way to reveal images across users due to a missing permission check.

• Google Android

In multiple locations, there is a possible code execution due to type confusion.

• Google Android

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check.

• Google Android

In setMetadata of MediaSessionRecord.java, there is a possible way to view another user's images due to a confused deputy.

• Google Android

In multiple functions of DevicePolicyManager.java, there is a possible way to prevent enabling the Find my Device feature due to improper input validation.

• Google Android

In multiple functions of StatusHints.java, there is a possible way to reveal images across users due to a confused deputy.

• Google Android

In TRANSPOSER_SETTINGS of lpp_tran.h, there is a possible out of bounds write due to an incorrect bounds check.

• Google Android

In multiple functions of KeyguardViewMediator.java, there is a possible failure to lock after screen timeout due to a logic error in the code.

• Google Android

In setMediaButtonBroadcastReceiver of MediaSessionRecord.java, there is a possible permanent DoS due to resource exhaustion.

• Google Android

In visitUris of RemoteViews.java, there is a possible cross-user media read due to a confused deputy.

• Google Android

In multiple locations, there is a possible way to obscure the microphone privacy indicator due to a logic error in the code.

• Google Android

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check.

• Google Android

In writeToParcel of CursorWindow.cpp, there is a possible information disclosure due to uninitialized data.

• Google Android

In decideCancelProvisioningDialog of AdminIntegratedFlowPrepareActivity.java, there is a possible way to bypass factory reset protections due to a logic error in the code.

• Google Android

In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In SDP_AddAttribute of sdp_db.cc, there is a possible out of bounds write due to an incorrect bounds check.

• Google Android

Improper privilege management in Google Android

• Google Android
• Privilege escalation

In parseInputs of ShimPreparedModel.cpp, there is a possible out of bounds read due to improper input validation.

• Google Android

In startActivityInner of ActivityStarter.java, there is a possible way to launch an activity into PiP mode from the background due to BAL bypass.

• Google Android
• Privilege escalation

In update of MmsProvider.java, there is a possible way to change directory permissions due to a path traversal error.

• Google Android

Information disclosure in Google Android

• Google Android
• Information disclosure

Improper certificate validation in Google Android

• Google Android
• Weak cryptography or TLS

In multiple functions of mem_protect.c, there is a possible way to access hypervisor memory due to a memory access check in the wrong place.

• Google Android

In isServerCertChainValid of InsecureEapNetworkHandler.java, there is a possible way to trust an imposter server due to a logic error in the code.

• Google Android

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Insufficiently protected credentials in Google Android

• Google Android
• Hard-coded credentials

In getLocationCache of GeoLocation.java, there is a possible way to send a mock location during an emergency call due to improper input validation.

• Google Android
• CWE-273

In notification access permission dialog box, malicious application can embedded a very long service label that overflow the original user prompt and possibly contains mis-leading information to be a…

• Google Android

In DMPixelLogger_ProcessDmCommand of DMPixelLogger.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In incfs_kill_sb of fs/incfs/vfs.c, there is a possible memory corruption due to a use after free.

• Google Android

there is a possible out of bounds read due to a missing bounds check.

• Google Android

In multiple functions of io_uring.c, there is a possible kernel memory corruption due to improper locking.

• Google Android

there is a possible way to bypass cryptographic assurances due to a logic error in the code.

• Google Android

In startInput of AudioPolicyInterfaceImpl.cpp, there is a possible way of erroneously displaying the microphone privacy indicator due to a race condition.

• Google Android

In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check.

• Google Android

Incorrect authorization in Google Android

• Google Android
• Broken access control

In multiple functions of binder.c, there is a possible memory corruption due to a use after free.

• Google Android