Google Android vulnerabilities and fixes
Exploited and high-severity Google Android vulnerabilities tracked by VulnFeed, with CVSS and EPSS scores, affected versions and fixes.
- 7.8CVE-2026-49906An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.carVerify fixGoogle Android
1 min read - 7.4CVE-2026-59042In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition.Verify fixGoogle Android
1 min read - 7.4CVE-2026-59043In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition.Verify fixGoogle Android
1 min read - 7.4CVE-2026-59045In multiple locations, there is a possible memory corruption due to a race condition.Verify fixGoogle Android
1 min read - 8.4CVE-2026-59016In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal.Verify fixGoogle Android
1 min read - 8.4CVE-2026-59004In multiple locations, there is a possible permission bypass due to an uncaught exception.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58968In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58974In multiple locations, there is a possible permission bypass due to a missing permission check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58957In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58962In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58964In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58966In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58944In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58946In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58934In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58866In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission Verify fixGoogle Android
1 min read - 8.4CVE-2026-58867In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check.Verify fixGoogle Android
1 min read - 7.8CVE-2026-58836In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideVerify fixGoogle Android
1 min read - 8.4CVE-2026-58837In multiple locations, there is a possible background activity launch due to a logic error in the code.Verify fixGoogle Android
1 min read - 7.5CVE-2026-58853In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-55287In onCreate of GrantCredentialsPermissionActivity.java, there is a possible way to trick the user into granting account credentials due to misleading Verify fixGoogle Android
1 min read - 8.4CVE-2026-55271In forwardToPreferredActionPickHandler of ContactsPickerActivity.kt, there is a possible intent redirection due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-55263In multiple functions of AllowBindAppWidgetActivity.java, there is a possible misunderstanding of reject/consent actions due to misleading or insufficVerify fixGoogle Android
1 min read - 8.4CVE-2026-55257In UsbDialogHelper of UsbDialogHelper.java, there is a possible UI confusion due to misleading or insufficient UI.Verify fixGoogle Android
1 min read - 8.4CVE-2026-45514In multiple functions of SaveUi.java, there is a possible bypass of package installation requirements due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-49923In onResult of AccountManagerService.java, there is a possible untrusted/misleading UI issue due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-28588In shouldBlockDirectoryFromTree of ExternalStorageProvider.java, there is a possible way to access protected data due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-28597In writeGrantedUriPermissions of UriGrantsManagerService.java, there is a possible permission bypass due to improper input validation.Verify fixGoogle Android
1 min read - 8.4CVE-2026-59044In multiple locations, there is a possible use-after-free due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-59028In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-59014In multiple locations, there is a possible out-of-bounds write due to an integer overflow.Verify fixGoogle Android
1 min read - 8.4CVE-2026-59005In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-59000In multiple locations, there is a possible permission bypass due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58995In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58994In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58989In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58986In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58984In multiple locations, there is a possible memory corruption due to a use-after-free.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58979In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58975In multiple locations, there is a possible out-of-bounds write due to a missing bounds check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58970In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58965In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58956In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58943In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58942In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58885In multiple locations, there is a possible permission bypass due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58884In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58879In descramble of multiple files, there is a possible out-of-bounds write due to improper casting.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58871In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58847In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58845In multiple locations, there is a possible out of bounds write due to an integer overflow.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58844In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58829In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free.Verify fixGoogle Android
1 min read - 7.4CVE-2026-58828In multiple functions of base.c, there is a possible use-after-free due to a race condition.Verify fixGoogle Android
1 min read - 7.4CVE-2026-58827In multiple functions of dma-buf.c, there is a possible use after free due to a race condition.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58826In ksys_unshare of fork.c, there is a possible memory corruption due to a use after free.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58825In multiple functions of fork.c, there is a possible use after free due to a logic error in the code.Verify fixGoogle Android
1 min read - 8.4CVE-2026-58824In __pkvm_load_tracing of trace.c, there is a possible out-of-bounds write due to an incorrect bounds check.Verify fixGoogle Android
1 min read - 8.4CVE-2026-55289In multiple functions in multiple locations, there is a possible execution of sensitive USSD codes due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-55288In validEfCfis of SIMRecords.java, there is a possible way to cause a denial of service due to an uncaught exception.Verify fixGoogle Android
1 min read - 8.4CVE-2026-55283In multiple locations, there is a possible memory safety issue due to a use-after-free.Verify fixGoogle Android
1 min read - 8.4CVE-2026-55275In multiple locations, there is a possible use-after-free due to a race condition.Verify fixGoogle Android
1 min read - 8.4CVE-2026-55262In setNotificationListenerAccessGrantedForUserInternal of NotificationManagerService.java, there is a possible policy desynchronization due to impropeVerify fixGoogle Android
1 min read - 8.4CVE-2026-55261In nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code execution due to a missing permission check.Verify fixGoogle Android
1 min read - 7.8CVE-2026-49934In multiple functions of MmiUtils.java, there is a possible risk of USSD/MMI code execution due to improper input validation.Verify fixGoogle Android
1 min read - 8.4CVE-2026-49931In onActivityResult in multiple locations, there is a possible contact leak from protected profile due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-49922In queryRemoteConnectionServices of ConnectionServiceWrapper.java, there is a possible permission bypass due to a confused deputy.Verify fixGoogle Android
1 min read - 8.4CVE-2026-28665In onCreate of SettingsApplication.java, there is a possible cross-profile consent dialog label injection due to improper input validation.Verify fixGoogle Android
1 min read - 8.4CVE-2026-0053In multiple locations, there is a possible method for a primary user to disable secure nfc on other full users due to insufficient isolation between AVerify fixGoogle Android
1 min read - 8.4CVE-2025-22436In multiple locations, there is a possible way to trick a user into disclosing Autofill contents due to a tapjacking/overlay attack.Verify fixGoogle Android
1 min read