Google Android.

In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass.

• Google Android

In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

• Google Android

In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check.

• Google Android

In Slice, there is a possible disclosure of installed packages due to a missing permission check.

• Google Android

In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

• Google Android

In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure.

• Google Android

Observable discrepancy in Google Android

• Google Android
• Information disclosure

Missing authorization in Google Android

• Google Android
• Broken access control

Use after free in Google Android

• Google Android
• Memory corruption

In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy.

• Google Android

In FillUi of FillUi.java, there is a possible way to view another user's images due to a confused deputy.

• Google Android

In multiple functions of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.

• Google Android

In setHeader of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.

• Google Android

In applyCustomDescription of SaveUi.java, there is a possible way to view another user's images due to a confused deputy.

• Google Android

In isFullScreen of FillUi.java, there is a possible way to view another user's images due to a confused deputy.

• Google Android

In multiple locations of DialogFillUi.java, there is a possible way to view another user's images due to a confused deputy.

• Google Android

Use after free in Google Android

• Google Android
• Memory corruption

In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code.

• Google Android

In build_read_multi_rsp of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow.

• Google Android

In several functions of xmlregexp.c, there is a possible out of bounds write due to a heap buffer overflow.

• Google Android

In multiple locations, there is a possible way to access screenshots due to a confused deputy.

• Google Android

In onCreate of ApnEditor.java, there is a possible way for a Guest user to change the APN due to a permission bypass.

• Google Android

In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy.

• Google Android

In appendEscapedSQLString of DatabaseUtils.java, there is a possible SQL injection due to unsafe deserialization.

• Google Android

In multiple locations, there is a possible way to bypass user notification of foreground services due to improper input validation.

• Google Android

Incorrect authorization in Google Android

• Google Android
• Broken access control

In onTaskAppeared of PipTaskOrganizer.java, there is a possible way to bypass background activity launch restrictions due to a logic error in the code.

• Google Android

In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In multiple functions of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

there is a possible use-after-free write due to improper locking.

• Google Android

In TBD of TBD, there is a possible way to bypass carrier restrictions due to a logic error in the code.

• Google Android

In temp_residency_name_store of thermal_metrics.c, there is a possible out of bounds write due to a missing bounds check.

• Google Android

there is a possible out of bounds write due to buffer overflow.

• Google Android

In ProfSixDecomTcpSACKoption of RohcPacketCommon.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In lwis_transaction_client_cleanup of lwis_transaction.c, there is a possible way to corrupt memory due to a use after free.

• Google Android

In CanConvertPadV2Op of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds read due to a heap buffer overflow.

• Google Android

In ctrl_roi of stmvl53l1_module.c, there is a possible out of bounds read due to an incorrect bounds check.

• Google Android

In TBD of TBD, there is a possible way to access location information due to a permissions bypass.

• Google Android

In ProtocolEmergencyCallListIndAdapter::Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In several functions of Exynos modem files, there is a possible out of bounds write due to a missing bounds check.

• Google Android

In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check.

• Google Android

In TBD of TBD, there is a possible stack buffer overflow due to a missing bounds check.

• Google Android

In tbd of tbd, there is a possible memory corruption due to a race condition.

• Google Android

In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing permission check.

• Google Android

In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass.

• Google Android

In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion.

• Google Android

In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to improper input validation.

• Google Android

Missing authorization in Google Android

• Google Android
• Broken access control

In MtpPropertyValue of MtpProperty.h, there is a possible memory corruption due to a use after free.

• Google Android

In avdt_msg_asmbl of avdt_msg.cc, there is a possible out of bounds write due to an integer overflow.

• Google Android

In bindSelection of DatabaseUtils.java, there is a possible way to access files from other applications due to SQL injection.

• Google Android

In hasPermissionForActivity of PackageManagerHelper.java, there is a possible way to start arbitrary components due to a confused deputy.

• Google Android

In eatt_l2cap_reconfig_completed of eatt_impl.h, there is a possible out of bounds write due to an integer overflow.

• Google Android

Unsafe reflection in Google Android

• Google Android
• Code injection

In MtpPropertyValue of MtpProperty.h, there is a possible out of bounds read due to uninitialized data.

• Google Android

Missing authorization in Google Android

• Google Android
• Broken access control

Improper privilege management in Google Android

• Google Android
• Privilege escalation

In loadMediaResumptionControls of MediaResumeListener.kt, there is a possible way to play and listen to media files played by another user on the same device due to a logic error in the code.

• Google Android

Improper privilege management in Google Android

• Google Android
• Privilege escalation