Google Android vulnerabilities

CVEs per yearBy the year they were published

1. 20204
2. 2023319
3. 2024411
4. 2025353
5. 2026556

Known exploitedNewest addition to KEV first

• CVE-2026-58704

  In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of…

  Google · Android

  ExploitedHigh8.8
• CVE-2025-48595

  In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege with no…

  Google · Android

  ExploitedHigh8.4
• CVE-2025-48633

  In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in the code.…

  Google · Android

  ExploitedMedium5.5
• CVE-2025-48572

  In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalation of…

  Google · Android

  ExploitedHigh7.8
• CVE-2025-48543

  In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local…

  Google · Android

  ExploitedHigh8.8
• CVE-2024-43093

  In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive directories due…

  Google · Android

  ExploitedHigh7.3
• CVE-2024-32896

  there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges…

  Google · Android

  ExploitedHigh8.1
• CVE-2024-29748

  there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges…

  Google · Android

  ExploitedHigh7.8
• CVE-2024-29745

  there is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution privileges…

  Google · Android

  ExploitedMedium5.5
• CVE-2023-35674

  In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation…

  Google · Android

  ExploitedHigh8.8

Newest CVEs

• CVE-2026-58977

  In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of…

  Google · Android

  Medium6.7
• CVE-2026-58930

  An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI.…

  Google · Android

  High7.8
• CVE-2026-58927

  The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within…

  Google · Android

  Medium6.7
• CVE-2026-58926

  A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using…

  Google · Android

  Low2.5
• CVE-2026-58925

  The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized…

  Google · Android

  High7.8
• CVE-2026-58924

  The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is…

  Google · Android

  High7.5
• CVE-2026-58915

  A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content…

  Google · Android

  Medium6.1
• CVE-2026-49906

  An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the…

  Google · Android

  High7.8
• CVE-2026-49903

  The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a…

  Google · Android

  Medium5.3
• CVE-2026-59048

  In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no…

  Google · Android

  Medium4.0