Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
11,156 results · page 22 of 224
Mar 3, 2026A vulnerability was determined in Tuya App and SDK 24.07.11 on Android.CVE-2026-3465 · Other software · Tuya · reported by VulDBLow 1.3
A vulnerability was determined in Tuya App and SDK 24.07.11 on Android. Affected by this vulnerability is an unknown functionality of the component JSON Data Point Handler. This manipulation of the argument cruise_time causes denial of service. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been publicly disclosed and may be utilized. There is ongoing doubt regarding the real existence of this vulnerability. The vendor disagrees with the conclusion of the finding: "The described vulnerability fails to prove its feasibility or exploitability by attackers. The issue essentially does not constitute a security vulnerability, aligning more closely with abnormal product functionality." These considerations are properly reflected within the CVSS vector.
- Product
- App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in OCVE-2025-47147 · Other software · Gallagher · reported by disclosures@gallagher.comMedium 5.7
Cleartext Storage of Sensitive Information (CWE-312) in the Command Centre Mobile Client on Android and iOS could allow an attacker with access to a logged-in Operator's mobile device to extract the session token and exploit access for a limited duration. This issue affects Command Centre Mobile Client versions prior to 9.40.123.
- Product
- Command Centre Mobile Client
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurity.gallagher.com
Mar 2, 2026In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check.CVE-2026-0047 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code.CVE-2026-0038 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple functions of mem_protect.c, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Mar 2, 2026In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code.CVE-2026-0037 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comsource.android.com
Mar 2, 2026In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code.CVE-2026-0035 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation.CVE-2026-0034 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In setPackageOrComponentEnabled of ManagedServices.java, there is a possible notification policy desync due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code.CVE-2026-0032 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In multiple functions of mem_protect.c, there is a possible out-of-bounds write due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Mar 2, 2026In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow.CVE-2026-0031 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple functions of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Mar 2, 2026In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds check.CVE-2026-0030 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In __host_check_page_state_range of mem_protect.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Mar 2, 2026In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code.CVE-2026-0029 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In __pkvm_init_vm of pkvm.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Mar 2, 2026In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow.CVE-2026-0028 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Mar 2, 2026In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free.CVE-2026-0027 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.7
In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordandroid.googlesource.comandroid.googlesource.com
Mar 2, 2026In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code.CVE-2026-0026 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass.CVE-2026-0025 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missing permission check.CVE-2026-0024 · Computers, phones & browsers · Google · reported by security@android.comMedium 4
In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check.CVE-2026-0023 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy.CVE-2026-0021 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In hasInteractAcrossUsersFullPermission of AppInfoBase.java, there is a possible cross-user permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass.CVE-2026-0020 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In parsePermissionGroup of ParsedPermissionUtils.java, there is a possible way to bypass a consent dialog to obtain permissions due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code.CVE-2026-0017 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.7
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comseclists.org
Mar 2, 2026In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation.CVE-2026-0015 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.2
In multiple locations of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation.CVE-2026-0014 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.2
In isPackageNullOrSystem of AppOpsService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comseclists.org
Mar 2, 2026In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy.CVE-2026-0013 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In setupLayout of PickActivity.java, there is a possible way to start any activity as a DocumentsUI app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comseclists.org
Mar 2, 2026In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code.CVE-2026-0012 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.2
In setHideSensitive of ExpandableNotificationRow.java, there is a possible contact name leak due due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comseclists.org
Mar 2, 2026In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code.CVE-2026-0011 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comseclists.org
Mar 2, 2026In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check.CVE-2026-0010 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In onTransact of IDrmManagerService.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsource.android.comseclists.org
Mar 2, 2026In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy.CVE-2026-0008 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple functions of FaceEnroll.kt, there is a possible privilege escalation due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack.CVE-2026-0007 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.6
In writeToParcel of WindowInfo.cpp, there is a possible way to trick a user into accepting a permission due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow.CVE-2026-0006 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.8
In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps withoutCVE-2026-0005 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.2
In onServiceDisconnected of KeyguardServiceDelegate.java, there is a possible partial bypass of app pinning allowing limited interaction with other apps without knowing the LSKF due to a missing permission check. This could lead to local information disclosure where the extent of interaction and impact is app-dependent with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code.CVE-2025-48654 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In onStart of CompanionDeviceManagerService.java, there is a possible confused deputy due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code.CVE-2025-48653 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In loadDataAndPostValue of multiple files, there is a possible way to obscure permission usage due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple locations, there is a possible information disclosure due to SQL injection.CVE-2025-48650 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple locations, there is a possible information disclosure due to SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy.CVE-2025-48646 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In executeRequest of ActivityStarter.java, there is a possible launch anywhere due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation.CVE-2025-48645 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In loadDescription of DeviceAdminInfo.java, there is a possible persistent package due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple locations, there is a possible persistent denial of service due to improper input validation.CVE-2025-48644 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code.CVE-2025-48642 · Computers, phones & browsers · Google · reported by security@android.comMedium 5.5
In jump_to_payload of payload.rs, there is a possible information disclosure due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of Nfc.h, there is a possible use after free due to a race condition.CVE-2025-48641 · Computers, phones & browsers · Google · reported by security@android.comHigh 7
In multiple functions of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error.CVE-2025-48636 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In openFile of BugreportContentProvider.java, there is a possible way to read and write unauthorized files due to a path traversal error. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code.CVE-2025-48635 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.7
In multiple functions of TaskFragmentOrganizerController.java, there is a possible activity token leak due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check.CVE-2025-48634 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.3
In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure.CVE-2025-48630 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.4
In drawLayersInternal of SkiaRenderEngine.cpp, there is a possible way to access the GPU cache due to side channel information disclosure. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code.CVE-2025-48619 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple functions of ContentProvider.java, there is a possible way for an app with read-only access to truncate files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the same key.CVE-2025-48613 · Computers, phones & browsers · Google · reported by security@android.comHigh 7.8
In VBMeta, there is a possible way to modify and resign VBMeta using a test key, assuming the original image was previously signed with the same key. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a patCVE-2025-48609 · Computers, phones & browsers · Google · reported by security@android.comCritical 9.1
In multiple functions of MmsProvider.java, there is a possible way to arbitrarily delete files which affect telephony, SMS, and MMS functionalities due to a path traversal error. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code.CVE-2025-48605 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple functions of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code.CVE-2025-48602 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In exitKeyguardAndFinishSurfaceBehindRemoteAnimation of KeyguardViewMediator.java, there is a possible lockscreen bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation.CVE-2025-48587 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.2
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation.CVE-2025-48585 · Computers, phones & browsers · Google · reported by security@android.comMedium 6.2
In multiple functions of ProfilingService.java, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 2, 2026In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect.CVE-2025-48582 · Computers, phones & browsers · Google · reported by security@android.comHigh 8.4
In multiple locations, there is a possible way to delete media without the MANAGE_EXTERNAL_STORAGE permission due to an intent redirect. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Product
- Android
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.