CVE Vulnerability Advisory Database

[Affected Scope] Google Pixel devices and Android hardware utilizing specific cellular modem chipsets.

[Impact] Remote (proximal/adjacent) attackers can bypass permissions to escalate privileges without user interaction, leading to full modem compromise.

[Mitigation] Immediately apply the September 2026 or later Android security patches (2026-09-01).

[Affected Scope] Multiple components within the Android Operating System (OS)

[Impact] Local privilege escalation (LPE) and arbitrary code execution without requiring additional privileges or user interaction, actively exploited in the wild

[Mitigation] Immediately apply the Android June 2026 Security Patch Level or later

[Affected Scope] Mobile and embedded devices powered by Qualcomm chipsets running affected Android kernel versions

[Impact] Local attackers can trigger an integer overflow (CWE-190) during memory alignment, leading to memory corruption and local privilege escalation (LPE) to kernel level

[Mitigation] Immediately apply the March 2026 security patches released by Qualcomm and Android OEMs

[Affected Scope] Android OS devices utilizing the DevicePolicyManagerService component

[Impact] Local attackers can exploit a logic error to register a Device Owner after provisioning, leading to local privilege escalation (EoP) without user interaction

[Mitigation] Apply the official Google Android December 2025 security patch or the latest OEM firmware update immediately

[Affected Scope] Multiple versions of Android OS and framework-based devices

[Impact] Local attackers can bypass background activity launch restrictions to achieve Local Privilege Escalation (LPE) without any user interaction or additional execution privileges

[Mitigation] Immediately apply the latest security patches (December 2025 or later) provided by Google and device OEMs, and restrict unauthorized app installations

[Affected Scope] Samsung Android mobile devices and the embedded libimagecodec.quram.so library prior to the SMR Sep-2025 Release 1 security patch

[Impact] Remote attackers can execute arbitrary code with high privileges without user interaction by tricking the system into processing a specially crafted image file

[Mitigation] Immediately apply the Samsung official software update (SMR Sep-2025 Release 1 or later) and restrict automatic downloading of media files from untrusted sources

[Affected Scope] Samsung Android mobile devices running security patch levels prior to SMR Apr-2025 Release 1

[Impact] Remote attackers can execute arbitrary code with high privileges and compromise the device without user interaction by triggering an out-of-bounds write during image decoding.

[Mitigation] Immediately apply the Samsung April 2025 Security Maintenance Release (SMR Apr-2025 Release 1) or later.

[Affected Scope] Android Operating System and Chrome browser environments

[Impact] Local attackers can escape the Chrome sandbox and escalate privileges to system_server without any user interaction or additional execution privileges

[Mitigation] Immediately apply the Android Security Bulletin - September 2025 patch or later to all affected devices

[Affected Scope] Mobile devices running Android OS utilizing the ExternalStorageProvider component

[Impact] Local attackers can bypass file path filters to access sensitive system directories, leading to local privilege escalation without requiring elevated execution privileges

[Mitigation] Apply the Google Android March 2025 security patch and upgrade device firmware to the latest version

[Affected Scope] Google Pixel devices and Android-based endpoints running security patch levels prior to 2024-06-01

[Impact] Local attackers can exploit a logic error to bypass security boundaries and achieve local privilege escalation (LPE) without requiring elevated execution privileges

[Mitigation] Immediately apply the official Google June 2024 or later security update to all affected devices

[Affected Scope] Google Pixel devices and Android operating system versions prior to April 2024 security patch

[Impact] Local attackers can bypass memory protection mechanisms during bootloader transitions to dump memory, extract cryptographic keys, and escalate privileges

[Mitigation] Apply the Google April 2024 Pixel Security Update immediately to patch the bootloader logic

[Affected Scope] Google Pixel devices and Android operating system

[Impact] Local attackers can disclose sensitive system memory information without requiring additional execution privileges or user interaction

[Mitigation] Immediately apply the April 2024 Google Pixel security update and upgrade to the latest firmware version

[Affected Scope] Android OS System Framework

[Impact] Local attackers can bypass background activity launch restrictions to execute arbitrary activities without user interaction, leading to local privilege escalation

[Mitigation] Apply the Google Android September 2023 Security Patch or update to the latest vendor-provided firmware immediately

[Affected Scope] Android 13 operating system (Android-13, Android ID: A-251586912)

[Impact] Attackers can hide mandatory foreground service notifications without user interaction, enabling stealthy background execution and unauthorized local information disclosure

[Mitigation] Apply the official June 2023 (or later) Android security patch and restrict notification permissions for untrusted applications

[Affected Scope] Samsung Android mobile devices running firmware versions prior to the SMR May-2023 Release 1 security update

[Impact] A privileged local attacker can read exposed kernel pointers in system log files to bypass ASLR (Address Space Layout Randomization), facilitating subsequent kernel-level code execution

[Mitigation] Apply the Samsung May 2023 security update (SMR May-2023 Release 1) or later, and restrict access to sensitive system logs

[Affected Scope] Android operating system versions 11, 12, 12L, and 13

[Impact] Local attackers can escalate privileges to the SYSTEM level without any user interaction or additional execution privileges

[Mitigation] Immediately update the system to the March 2023 Android Security Patch Level (2023-03-01) or later

[Affected Scope] Google Chrome on Android prior to version 104.0.5112.101

[Impact] Remote attackers can force arbitrary browsing to malicious websites via crafted HTML pages exploiting insufficient Intent validation

[Mitigation] Immediately update Google Chrome on Android to version 104.0.5112.101 or later

[Affected Scope] Samsung mobile devices running firmware versions prior to SMR (Security Maintenance Release) MAY-2021 Release 1

[Impact] Local attackers with compromised radio privileges can bypass signature checks via a race condition, leading to arbitrary code execution in the kernel context

[Mitigation] Apply the official Samsung security update (SMR MAY-2021 Release 1 or later) immediately and restrict unauthorized application installation

[Affected Scope] Samsung mobile devices running firmware versions prior to SMR (Samsung Security Maintenance Release) MAY-2021 Release 1.

[Impact] A local attacker with compromised radio privileges can trigger a race condition to perform an arbitrary write in kernel memory, leading to local privilege escalation (LPE).

[Mitigation] Apply the official Samsung security update (SMR MAY-2021 Release 1 or later) and restrict unauthorized local application execution.

[Affected Scope] Samsung Android devices prior to SMR (Samsung Maintenance Release) March 2021 Release 1

[Impact] Local attackers can bypass critical kernel protections like KASLR by reading sensitive kernel memory addresses and structures from the improperly secured sec_log file

[Mitigation] Apply the official Samsung SMR March 2021 Release 1 (or later) firmware update immediately, or restrict access permissions to the debug log node