Threat database

CVE-2026-28640 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, and 16. It arises from improper input validation in the checkCallerIsCertInstallerOrSelfInProfile function of CredentialStorageActivity.java, allowing a local attacker to bypass permissions and escalate privileges without requiring additional execution privileges or user interaction.

CVE-2026-28625 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It arises from a logic error causing possible permission bypass in multiple code locations, allowing local attackers to escalate privileges without needing additional execution rights or user interaction.

CVE-2026-58880 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It arises from a race condition in the handle_app_val_response function of the btif_rc.cc component. Exploitation does not require user interaction and can lead to local code execution with elevated privileges.

CVE-2026-58865 is a denial of service vulnerability in multiple functions of PduParser.java in Google Android. It results from a missing bounds check that allows remote attackers to cause persistent denial of service without user interaction or privileges. The vulnerability affects Android versions 14 through 17 and 16-qpr2. No official patch information is provided.

CVE-2026-58859 is a high severity denial of service vulnerability in Google Android version 17. It arises from uncaught exceptions in multiple locations, potentially allowing local privilege escalation without requiring user interaction.

CVE-2026-58856 is a low-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It arises from a missing bounds check in the DeprecatedCamera3StreamSplitter.cpp component, leading to a possible out-of-bounds read. Exploitation does not require user interaction and does not grant additional execution privileges but may disclose local information.

CVE-2026-58854 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. The flaw involves possible memory corruption due to type confusion in multiple locations, allowing local attackers to escalate privileges without needing additional execution rights or user interaction.

CVE-2026-58841 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14 through 17. It arises from a logic error in multiple functions of VirtualAudioControllerTest.java, allowing a local attacker to bypass permissions and escalate privileges without requiring user interaction.

CVE-2026-58835 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It involves a heap buffer overflow in the cfg2prop function of btif_storage.cc, which can cause an out-of-bounds write. Exploitation does not require user interaction and could lead to remote code execution with elevated privileges.

CVE-2026-58834 is a medium severity vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It involves improper input validation in the setPermissionGrantState function of DevicePolicyManagerService.java, which can cause a persistent local denial of service without requiring user interaction or additional privileges.

CVE-2026-58815 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It involves a possible out-of-bounds write due to incorrect bounds checking in multiple locations. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-55286 is a high-severity elevation of privilege vulnerability in Google Android version 17. It arises from an out-of-bounds write in the stpropnci_process function due to an incorrect bounds check. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-55280 is a high-severity elevation of privilege vulnerability in Google Android versions 16, 16-qpr2, and 17. It involves a possible out-of-bounds write caused by uninitialized data in multiple locations. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-55270 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. The flaw exists in the dialInternal component where a permission bypass occurs due to a confused deputy issue. Exploitation does not require user interaction or additional execution privileges, enabling local attackers to escalate privileges.

CVE-2026-55269 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It arises from improper input validation in the FilterCapturedPacket function of snoop_logger.cc, leading to a possible memory safety issue. Exploitation does not require user interaction or additional execution privileges.

CVE-2026-55266 is a high-severity vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It involves a possible out-of-bounds write in the qsort function of libufdt_sysdeps_vendor.c due to resource exhaustion. This flaw can lead to a denial of service and local privilege escalation without requiring user interaction.

CVE-2026-55265 is a denial of service vulnerability in Google Android affecting multiple versions. It arises from a missing bounds check in several functions of PduParser.java, allowing out-of-bounds reads. Exploitation does not require user interaction or elevated privileges. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-49937 is a high-severity vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It involves an out-of-bounds read in multiple functions of MessageQueueBase.h due to incorrect bounds checking. Exploitation does not require user interaction and could lead to local privilege escalation without additional execution privileges.

CVE-2026-49933 is a high-severity vulnerability in Google Android affecting versions 16, 16-qpr2, and 17. It involves a possible control-flow hijack in the privileged Bluetooth process due to an uninitialized pointer dereference in the handle_le_monitor_device_event function. Exploitation does not require user interaction and could lead to local privilege escalation with full confidentiality, integrity, and availability impact.

CVE-2026-49885 is a high-severity elevation of privilege vulnerability in Google Android affecting versions 14, 15, 16, 16-qpr2, and 17. It arises from an integer overflow in the rw_t4t_update_file function of rw_t4t.cc, leading to a possible out-of-bounds write. Exploitation does not require user interaction or additional execution privileges.