Google Android vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20202
3. 2023335
4. 20238
5. 20232
6. 2024110
7. 202417
8. 2025358
9. 2026506
10. 2026303

Known exploitedNewest addition to KEV first

• CVE-2026-58704

  In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of…

  Google · Android

  ExploitedHigh8.8
• CVE-2025-48595

  In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no…

  Google · Android

  ExploitedHigh8.4
• CVE-2025-48633

  In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code.…

  Google · Android

  ExploitedMedium5.5
• CVE-2025-48572

  In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of…

  Google · Android

  ExploitedHigh7.8
• CVE-2025-48543

  In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local…

  Google · Android

  ExploitedHigh8.8
• CVE-2024-43093

  In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due…

  Google · Android

  ExploitedHigh7.3
• CVE-2024-32896

  there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges…

  Google · Android

  ExploitedHigh8.1
• CVE-2024-29748

  there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges…

  Google · Android

  ExploitedHigh7.8
• CVE-2024-29745

  there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges…

  Google · Android

  ExploitedMedium5.5
• CVE-2023-35674

  In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation…

  Google · Android

  ExploitedHigh8.8

Newest CVEs

• CVE-2026-58977

  In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of…

  Google · Android

  Medium6.7
• CVE-2026-58930

  An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI.…

  Google · Android

  Not scored
• CVE-2026-58927

  The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within…

  Google · Android

  Not scored
• CVE-2026-58926

  A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using…

  Google · Android

  Low2.5
• CVE-2026-58925

  The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized…

  Google · Android

  Not scored
• CVE-2026-58924

  The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is…

  Google · Android

  Not scored
• CVE-2026-58915

  A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content…

  Google · Android

  Medium6.1
• CVE-2026-49906

  An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the…

  Google · Android

  High7.8
• CVE-2026-49903

  The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a…

  Google · Android

  Not scored
• CVE-2026-59048

  In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no…

  Google · Android

  Not scored