CVE Vulnerability Advisory Database

[Affected Scope] Google Pixel devices and Android hardware utilizing specific cellular modem chipsets.

[Impact] Remote (proximal/adjacent) attackers can bypass permissions to escalate privileges without user interaction, leading to full modem compromise.

[Mitigation] Immediately apply the September 2026 or later Android security patches (2026-09-01).

[Affected Scope] Multiple components within the Android Operating System (OS)

[Impact] Local privilege escalation (LPE) and arbitrary code execution without requiring additional privileges or user interaction, actively exploited in the wild

[Mitigation] Immediately apply the Android June 2026 Security Patch Level or later

[Affected Scope] Mobile and embedded devices powered by Qualcomm chipsets running affected Android kernel versions

[Impact] Local attackers can trigger an integer overflow (CWE-190) during memory alignment, leading to memory corruption and local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the March 2026 security patches released by Qualcomm and Android OEMs

[Affected Scope] Android OS devices utilizing the DevicePolicyManagerService component

[Impact] Local attackers can exploit a logic error to register a Device Owner after provisioning, leading to local privilege escalation (EoP) without user interaction

[Mitigation] Apply the official Google Android December 2025 security patch or the latest OEM firmware update immediately

[Affected Scope] Multiple versions of Android OS and framework-based devices

[Impact] Local attackers can bypass background activity launch restrictions to achieve Local Privilege Escalation (LPE) without any user interaction or additional execution privileges

[Mitigation] Immediately apply the latest security patches (December 2025 or later) provided by Google and device OEMs, and restrict unauthorized app installations

[Affected Scope] Samsung Android mobile devices and the embedded libimagecodec.quram.so library prior to the SMR Sep-2025 Release 1 security patch

[Impact] Remote attackers can execute arbitrary code with high privileges without user interaction by tricking the system into processing a specially crafted image file

[Mitigation] Immediately apply the Samsung official software update (SMR Sep-2025 Release 1 or later) and restrict automatic downloading of media files from untrusted sources

[Affected Scope] Samsung Android mobile devices running security patch levels prior to SMR Apr-2025 Release 1

[Impact] Remote attackers can execute arbitrary code with high privileges and compromise the device without user interaction by triggering an out-of-bounds write during image decoding.

[Mitigation] Immediately apply the Samsung April 2025 Security Maintenance Release (SMR Apr-2025 Release 1) or later.

[Affected Scope] Android Operating System and Chrome browser environments

[Impact] Local attackers can escape the Chrome sandbox and escalate privileges to system_server without any user interaction or additional execution privileges

[Mitigation] Immediately apply the Android Security Bulletin - September 2025 patch or later to all affected devices

[Affected Scope] Mobile devices running Android OS utilizing the ExternalStorageProvider component

[Impact] Local attackers can bypass file path filters to access sensitive system directories, leading to local privilege escalation without requiring elevated execution privileges

[Mitigation] Apply the Google Android March 2025 security patch and upgrade device firmware to the latest version

[Affected Scope] Google Pixel devices and Android-based endpoints running security patch levels prior to 2024-06-01

[Impact] Local attackers can exploit a logic error to bypass security boundaries and achieve local privilege escalation (LPE) without requiring elevated execution privileges

[Mitigation] Immediately apply the official Google June 2024 or later security update to all affected devices

[Affected Scope] Google Pixel devices and Android operating system versions prior to April 2024 security patch

[Impact] Local attackers can bypass memory protection mechanisms during bootloader transitions to dump memory, extract cryptographic keys, and escalate privileges

[Mitigation] Apply the Google April 2024 Pixel Security Update immediately to patch the bootloader logic

[Affected Scope] Google Pixel devices and Android operating system

[Impact] Local attackers can disclose sensitive system memory information without requiring additional execution privileges or user interaction

[Mitigation] Immediately apply the April 2024 Google Pixel security update and upgrade to the latest firmware version

[Affected Scope] Android OS System Framework

[Impact] Local attackers can bypass background activity launch restrictions to execute arbitrary activities without user interaction, leading to local privilege escalation

[Mitigation] Apply the Google Android September 2023 Security Patch or update to the latest vendor-provided firmware immediately

[Affected Scope] Android 13 operating system (Android-13, Android ID: A-251586912)

[Impact] Attackers can hide mandatory foreground service notifications without user interaction, enabling stealthy background execution and unauthorized local information disclosure

[Mitigation] Apply the official June 2023 (or later) Android security patch and restrict notification permissions for untrusted applications

[Affected Scope] Samsung Android mobile devices running firmware versions prior to the SMR May-2023 Release 1 security update

[Impact] A privileged local attacker can read exposed kernel pointers in system log files to bypass ASLR (Address Space Layout Randomization), facilitating subsequent kernel-level code execution

[Mitigation] Apply the Samsung May 2023 security update (SMR May-2023 Release 1) or later, and restrict access to sensitive system logs

[Affected Scope] Android operating system versions 11, 12, 12L, and 13

[Impact] Local attackers can escalate privileges to the SYSTEM level without any user interaction or additional execution privileges

[Mitigation] Immediately update the system to the March 2023 Android Security Patch Level (2023-03-01) or later

[Affected Scope] Google Chrome on Android prior to version 104.0.5112.101

[Impact] Remote attackers can force arbitrary browsing to malicious websites via crafted HTML pages exploiting insufficient Intent validation

[Mitigation] Immediately update Google Chrome on Android to version 104.0.5112.101 or later

[Affected Scope] Android devices powered by kernels utilizing the ARM Mali GPU driver

[Impact] Local attackers can achieve local privilege escalation (LPE) to kernel execution context without any user interaction

[Mitigation] Apply the March 2022 or later Android Security Patch Level (SPL) and update the kernel build

[Affected Scope] Android kernel and upstream Linux kernel integrated into mobile devices and embedded systems

[Impact] Local attackers can corrupt kernel memory and escalate privileges to Root without requiring any user interaction or additional execution privileges

[Mitigation] Apply the Android November 2021 Security Bulletin patch or upgrade to the patched upstream Linux kernel version

[Affected Scope] Android kernel and Linux kernel implementations of AF_UNIX sockets

[Impact] Local attackers can exploit this to gain System execution privileges without any user interaction, leading to full device compromise

[Mitigation] Apply the Android November 2021 security patch or update to the latest upstream Linux kernel version