security@android.com
organization01
roles
Roles this identity holds.
02
references
Other names and identifiers for this entity.
nvdUS security@android.com
03
assessed vulnerabilities (19)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-49883US | medium5.5 | — | ||
In checkReadPermission of PermissionsManager.java, there is a possible way to monitor sensitive device state data due to a missing permission check. This could lead to local inform… | ||||
| CVE-2026-28659US | high7.8 | — | ||
In MicroXR Blobstore, there is a possible way to access other app's files due to a missing permission check. This could lead to local escalation of privilege with no additional exe… | ||||
| CVE-2026-28573US | medium5.5OT elevated | — | ||
In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution… | ||||
| CVE-2026-28615US | high7.8OT elevated | — | ||
In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional executi… | ||||
| CVE-2026-28587US | medium5.5OT elevated | — | ||
In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosu… | ||||
| CVE-2026-28576US | medium5.5 | Exploit | ||
In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution pri… | ||||
| CVE-2026-28575US | medium5.5 | — | ||
In PackageInstaller.Session#transfer of frameworks/base/services/core/java/com/android/server/pm/PackageInstallerSession.java, there is a possible memory exhaustion attack due to a… | ||||
| CVE-2026-0092US | —OT elevated | Exploit | ||
In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional executi… | ||||
| CVE-2026-0083US | high7.0 | — | ||
In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileg… | ||||
| CVE-2026-0082US | high7.8 | — | ||
In tryStartActivity of NfcDispatcher.java, there is a possible automatic special app access permission assignment due to an insecure default value. This could lead to local escalat… | ||||
| CVE-2026-0081US | high7.8OT elevated | — | ||
In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges ne… | ||||
| CVE-2026-0071US | high7.8OT elevated | — | ||
In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privile… | ||||
| CVE-2026-0068US | high7.8 | — | ||
In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. Th… | ||||
| CVE-2026-0064US | medium5.5 | — | ||
In multiple places, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of service with no additional execution privileges… | ||||
| CVE-2026-0063US | high7.8 | — | ||
In setAllowedCarriers of PhoneInterfaceManager.java, there is a possible way to disable carrier restrictions due to a logic error in the code. This could lead to local escalation o… | ||||
| CVE-2026-0072US | high7.8 | — | ||
In addInputMethodListener of com.android.server.inputmethod.InputMethodManagerService, there is a missing permission check. This could lead to local escalation of privilege with no… | ||||
| CVE-2025-48611US | high7.8 | — | ||
In DeviceId of DeviceId.java, there is a possible desync in persistence due to a missing bounds check. This could lead to local escalation of privilege with no additional execution… | ||||
| CVE-2017-13322US | medium5.5 | — | ||
In endCallForSubscriber of PhoneInterfaceManager.java, there is a possible way to prevent access to emergency services due to a logic error in the code. This could lead to a local… | ||||
| CVE-2018-9416US | medium6.7 | — | ||
In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to
an unusual root cause. This could lead to local escalation of privilege with
System execution p… | ||||