[ Vendor · 17 CVEs ]
Android
CVEs affecting Android published in the last 30 days, plus any Android CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2025-48595 | 1 Jun 2026 | CVSS 8.4 | Android Framework Integer OverflowIn multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege… | Exploited |
| CVE-2025-48633 | 8 Dec 2025 | CVSS 5.5 | Android Framework Information DisclosureIn hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic error in… | ExploitedFix |
| CVE-2025-48572 | 8 Dec 2025 | CVSS 7.8 | Android Framework Privilege EscalationIn multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local… | Exploited |
| CVE-2025-48543 | 4 Sep 2025 | CVSS 8.8 | Android Runtime Use-After-FreeIn multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to… | ExploitedFix |
| CVE-2024-43093 | 13 Nov 2024 | CVSS 7.3 | Android Framework Privilege EscalationIn shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitive… | ExploitedFix |
| CVE-2024-32896 | 13 Jun 2024 | CVSS 7.8 | Android Pixel Privilege Escalationthere is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution… | Exploited |
| CVE-2024-36971 | 10 Jun 2024 | CVSS 7.8 | Android Kernel Remote Code ExecutionIn the Linux kernel, the following vulnerability has been resolved: net: fix __dst_negative_advice() race __dst_negative_advice() does not enforce… | ExploitedFix |
| CVE-2024-29745 | 5 Apr 2024 | CVSS 5.5 | Android Pixel Information Disclosurethere is a possible Information Disclosure due to uninitialized data. This could lead to local information disclosure with no additional execution… | Exploited |
| CVE-2024-29748 | 5 Apr 2024 | CVSS 7.8 | Android Pixel Privilege Escalationthere is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution… | Exploited |
| CVE-2023-35674 | 11 Sep 2023 | CVSS 7.8 | Android Framework Privilege EscalationIn onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local… | ExploitedFix |
| CVE-2023-21237 | 28 Jun 2023 | CVSS 5.5 | Android Pixel Information DisclosureIn applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading or… | Exploited |
| CVE-2023-20963 | 24 Mar 2023 | CVSS 7.8 | Android Framework Privilege EscalationIn WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed… | ExploitedFix |
| CVE-2021-1048 | 15 Dec 2021 | CVSS 7.8 | Android Kernel Use-After-FreeIn ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of… | ExploitedFix |
| CVE-2021-0920 | 15 Dec 2021 | CVSS 6.4 | Android Kernel Race ConditionIn unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition. This could lead to local escalation of privilege… | Exploited |
| CVE-2020-0041 | 10 Mar 2020 | CVSS 7.8 | Android Kernel Out-of-Bounds WriteIn binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of… | Exploited |
| CVE-2019-2215 | 11 Oct 2019 | CVSS 7.8 | Android Kernel Use-After-FreeA use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit… | ExploitedFix |
| CVE-2011-1823 | 9 Jun 2011 | CVSS 7.8 | Android OS Privilege EscalationThe vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows local… | Exploited |