Android vulnerabilities and fixes

CVEs that mention Android, ranked by priority. 152 tracked.

Android has 152 tracked vulnerabilities, 15 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 113. Most recent: 2026-10-23. Highest priority: CVE-2026-58704 (score 68/100).

• CVE-2026-58704 HIGH 8.8 EXPLOITED MITIGATE Google Pixel Improper Authorization Vulnerability
• CVE-2026-65768 HIGH 8.8 UPGRADE Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android
• CVE-2026-0163 CRITICAL 9.8 MITIGATE In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free
• CVE-2026-114357 CRITICAL 9.3 Missing authentication for a critical function in the Android Debug Bridge daemon (adbd) in DJI CrystalSky ZS6
• CVE-2026-113263 CRITICAL 9.6 UPGRADE Use after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to pote
• CVE-2026-65767 HIGH 8.8 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for An
• CVE-2026-70386 HIGH 8.5 Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authori
• CVE-2026-18907 HIGH 7.5 Path Traversal in Download File Feature in com.talpa.hibrowser 2.23.1.1 on Android allows arbitrary file write
• CVE-2026-65802 HIGH 7.4 UPGRADE External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclos
• CVE-2026-113092 HIGH 8.8 UPGRADE Use after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113099 HIGH 8.8 UPGRADE Improper input validation in Omnibox in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote at
• CVE-2026-114355 HIGH 8.6 OS command injection in the root-privileged 'hardware_monitor' helper in DJI CrystalSky ZS600C firmware v0.3.9
• CVE-2026-49004 MEDIUM 6.5 The built-in PostgreSQL service on the mobile device suffers from misconfiguration flaws and command injection
• CVE-2023-29536 HIGH 8.8 UPGRADE UPGRADE An attacker could cause the memory manager to incorrectly free a pointer that addresses attacker-controlled me
• CVE-2023-29539 HIGH 8.8 UPGRADE UPGRADE When handling the filename directive in the Content-Disposition header, the filename would be truncated if the
• CVE-2023-29550 HIGH 8.8 UPGRADE UPGRADE Memory safety bugs present in Firefox 111 and Firefox ESR 102.9
• CVE-2026-17676 CRITICAL 9.6 UPGRADE Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-76036 CRITICAL 9.6 UPGRADE Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to ex
• CVE-2023-25747 HIGH 7.5 UPGRADE A potential use-after-free in libaudio was fixed by disabling the AAudio backend when running on Android API b
• CVE-2026-113169 CRITICAL 9.6 UPGRADE Memory corruption in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote att
• CVE-2026-113171 CRITICAL 9.6 UPGRADE Memory corruption in Prompts in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker t
• CVE-2026-16881 HIGH 8.7 A code injection vulnerability exists in the LINE Android app prior to version 26.7.2
• CVE-2026-113163 HIGH 8.8 UPGRADE Use after free in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to exe
• CVE-2026-17681 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Web Authentication in Google Chrome on Android prior to 151.0.79
• CVE-2026-113217 HIGH 8.8 UPGRADE Use after free in WebAppInstalls in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attack
• CVE-2026-17677 HIGH 8.8 UPGRADE Inappropriate implementation in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-19157 CRITICAL 9.6 UPGRADE Out of bounds write in ANGLE in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to
• CVE-2026-0298 HIGH 8.1 UPGRADE An improper input validation vulnerability exists in the Windows Pre-Logon Access Provider (PLAP) component of
• CVE-2026-113088 HIGH 8.8 UPGRADE Memory corruption in Mobile in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113091 HIGH 8.8 UPGRADE Use after free in PerformanceAPIs in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attac
• CVE-2026-113096 HIGH 8.8 UPGRADE Memory corruption in Text in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to e
• CVE-2026-113107 HIGH 8.8 UPGRADE Use after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to exe
• CVE-2026-113145 HIGH 8.8 UPGRADE Memory corruption in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker
• CVE-2026-113156 HIGH 8.8 UPGRADE Use after free in Messages in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-17651 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Dawn in Google Chrome on Android prior to 151.0.7922.72 allowed
• CVE-2026-17713 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Accessibility in Google Chrome on Android prior to 151.0.7922.72
• CVE-2026-17726 CRITICAL 9.6 UPGRADE Integer overflow in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to pote
• CVE-2026-17727 CRITICAL 9.6 UPGRADE Out of bounds write in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to p
• CVE-2026-17940 CRITICAL 9.6 UPGRADE Insufficient validation of untrusted input in Picture-in-Picture in Google Chrome on Android prior to 151.0.79
• CVE-2026-19170 CRITICAL 9.6 UPGRADE Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker to poten
• CVE-2023-29535 MEDIUM 6.5 UPGRADE UPGRADE Following a Garbage Collector compaction, weak maps may have been accessed before they were correctly traced
• CVE-2023-29548 MEDIUM 6.5 UPGRADE UPGRADE A wrong lowering instruction in the ARM64 Ion compiler resulted in a wrong optimization result
• CVE-2026-113121 HIGH 8.8 UPGRADE Memory corruption in ContextMenu in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attack
• CVE-2026-113164 HIGH 8.8 UPGRADE Memory corruption in Voice in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to
• CVE-2026-113207 HIGH 8.8 UPGRADE Use after free in SiteIsolation in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacke
• CVE-2026-66310 HIGH 7.7 UPGRADE External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclos
• CVE-2026-17698 HIGH 7.5 UPGRADE Insufficient validation of untrusted input in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a
• CVE-2026-19154 HIGH 8.3 UPGRADE Use after free in Skia in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had c
• CVE-2026-76046 HIGH 8.3 UPGRADE Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker who
• CVE-2026-17663 HIGH 8.3 UPGRADE Insufficient validation of untrusted input in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a
• CVE-2026-17722 HIGH 8.3 UPGRADE Object lifecycle issue in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker
• CVE-2026-19137 HIGH 8.3 UPGRADE Use after free in WebGL in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had
• CVE-2026-19141 HIGH 8.3 UPGRADE Use after free in Resources in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who
• CVE-2026-62828 MEDIUM 5.4 MITIGATE Improper input validation in Microsoft Edge for Android allows an unauthorized attacker to perform tampering o
• CVE-2026-70640 HIGH 7.0 UPGRADE llama.cpp builds b1886 through b7445 contain a race condition use-after-free vulnerability in the LLaMA-Androi
• CVE-2026-0296 HIGH 7.4 UPGRADE UPGRADE Improper certificate validation vulnerabilities in Palo Alto Networks GlobalProtect™ app enable an unauthentic
• CVE-2026-114354 HIGH 8.6 Missing authorization in the native binder service 'android.dji.server' (transaction code 1018) in DJI Crystal
• CVE-2026-47364 MEDIUM 6.5 In versions of the Datadog Android application prior to v545-5.9.2, the app tags Crashlytics data with the use
• CVE-2026-17816 HIGH 7.5 UPGRADE Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote
• CVE-2026-19143 HIGH 8.6 UPGRADE Insufficient validation of untrusted input in WebAPKs in Google Chrome on Android prior to 151.0.7922.109 allo
• CVE-2026-21061 MEDIUM 6.5 MITIGATE Improper input validation in Samsung Dialer prior to SMR Aug-2026 Release 1 allows remote attackers to access
• CVE-2026-43622 HIGH 7.8 UPGRADE llama.cpp builds b1886 through b7445 contain a double free vulnerability in the LLaMA-Android JNI wrapper wher
• CVE-2026-70638 HIGH 7.8 UPGRADE llama.cpp builds b1886 through b7445 contain an integer overflow vulnerability in the LLaMA-Android JNI wrappe
• CVE-2026-71392 MEDIUM 5.3 GNU Emacs for Android is vulnerable to an integer overflow in the sfnt_read_cmap_format_12() function in src/s
• CVE-2026-71393 MEDIUM 5.3 GNU Emacs for Android is vulnerable to an integer overflow in sfnt_read_name_table() in src/sfnt.c
• CVE-2026-0299 HIGH 7.8 UPGRADE UPGRADE Local privilege escalation vulnerabilities in the Palo Alto Networks GlobalProtect™ app enable a local user to
• CVE-2026-17968 MEDIUM 6.5 UPGRADE Uninitialized Use in WebXR in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to obt
• CVE-2026-18809 MEDIUM 6.5 Information disclosure in Firefox for Android and Firefox Focus for Android
• CVE-2026-70387 HIGH 8.4 Exposed dangerous method or function and Incorrect Authorization vulnerability in OnePlus OxygenOS on Android
• CVE-2026-71391 MEDIUM 5.3 GNU Emacs for Android contains an off-by-one error in the gvar table parser in src/sfnt.c
• CVE-2026-21068 HIGH 7.8 MITIGATE Stack-based buffer overflow in libril_sem.so prior to SMR Aug-2026 Release 1 allows privileged local attackers
• CVE-2026-44964 MEDIUM 6.5 In versions of the Datadog Android application prior to v545-5.9.2, OnCallNotificationActivity is declared exp
• CVE-2026-68922 MEDIUM 5.5 MobSF is a mobile application security testing tool used
• CVE-2026-76039 MEDIUM 6.5 UPGRADE Incorrect reference resolution in Core in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote
• CVE-2026-0294 HIGH 7.8 UPGRADE A privilege escalation (PE) vulnerability in the Palo Alto Networks Prisma® Access Agent app on Windows and ma
• CVE-2026-17741 HIGH 7.1 UPGRADE Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allow
• CVE-2026-17793 MEDIUM 6.5 UPGRADE Inappropriate implementation in Messages in Google Chrome on Android prior to 151.0.7922.72 allowed a remote a
• CVE-2026-17805 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Glic in Google Chrome on Android prior to 151.0.7922.72 allowed a remote at
• CVE-2026-17825 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remo
• CVE-2026-17953 MEDIUM 6.5 UPGRADE Insufficient policy enforcement in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote
• CVE-2026-21065 HIGH 7.8 MITIGATE Out-of-bounds write in libcodec2secqcelpdec.so prior to SMR Aug-2026 Release 1 allows local attackers to write
• CVE-2026-21066 HIGH 7.8 MITIGATE Improper input validation in libcodec2_sec_flacdec.so prior to SMR Aug-2026 Release 1 allows local attackers t
• CVE-2026-21067 HIGH 7.8 MITIGATE Improper input validation in libsmsd.so prior to SMR Aug-2026 Release 1 allows local attackers to write out-of
• CVE-2026-21069 HIGH 7.8 MITIGATE Incorrect conversion between numeric types in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows
• CVE-2026-21071 HIGH 7.8 MITIGATE Improper input validation in MPEG4 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attacker
• CVE-2026-21072 HIGH 7.8 MITIGATE Improper input validation in VC1 codec in libsavsvc.so prior to SMR Aug-2026 Release 1 allows local attackers
• CVE-2026-47361 MEDIUM 6.4 In versions of the Datadog Android application prior to v541-5.9.2, BubbleChatActivity is exported with no per
• CVE-2026-71394 MEDIUM 5.3 GNU Emacs for Android improperly validates the table header input in sfnt_read_table_directory() in src/sfnt.c
• CVE-2026-114353 HIGH 7.0 Hidden functionality (undocumented backdoor) in the root-privileged 'assistant' daemon in DJI CrystalSky ZS600
• CVE-2026-17690 MEDIUM 6.5 UPGRADE Insufficient validation of untrusted input in PDF in Google Chrome on Android prior to 151.0.7922.72 allowed a
• CVE-2026-74951 MEDIUM 6.5 UPGRADE Clickjacking issue in Firefox for Android
• CVE-2026-74980 MEDIUM 6.5 UPGRADE Clickjacking issue in the Downloads component in Firefox for Android
• CVE-2026-8497 HIGH 7.4 UPGRADE Improper certificate validation in the Devolutions Server connection handling in Devolutions Password Manager
• CVE-2026-114356 HIGH 7.0 Missing authorization in the system-privileged 'DJIUpdateService' binder in DJI CrystalSky ZS600C firmware v0.
• CVE-2026-17999 MEDIUM 6.5 UPGRADE Race in PictureInPicture in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to perfo
• CVE-2026-21058 HIGH 7.1 MITIGATE Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows local attackers to delete
• CVE-2026-47363 MEDIUM 6.3 In versions of the Datadog Android application prior to v541-5.9.2, the exported launcher activity AppActivity
• CVE-2026-53986 MEDIUM 5.3 Girafit camera app (Android and iOS) version 1.9.1 and earlier, and Girafit camera devices, contain a hardcode
• CVE-2026-0295 HIGH 7.0 UPGRADE A race condition in the Palo Alto Networks GlobalProtect™ client on macOS enables a locally authenticated low-
• CVE-2026-21059 HIGH 7.1 MITIGATE Improper export of android application components in Samsung Contacts prior to SMR Aug-2026 Release 1 allows l
• CVE-2026-19146 MEDIUM 5.3 UPGRADE Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had
• CVE-2026-21063 MEDIUM 6.1 MITIGATE Improper export of android application components in AppLock prior to SMR Aug-2026 Release 1 allows physical a
• CVE-2026-21073 MEDIUM 6.1 MITIGATE Improper input validation in Galaxy Themes prior to SMR Aug-2026 Release 1 allows physical attackers to launch
• CVE-2026-17736 MEDIUM 5.8 UPGRADE Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allow
• CVE-2026-17866 MEDIUM 5.8 UPGRADE Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had com
• CVE-2026-17915 MEDIUM 5.4 UPGRADE Inappropriate implementation in WebView in Google Chrome on Android prior to 151.0.7922.72 allowed a remote at
• CVE-2026-59717 MEDIUM 4.3 Home Assistant is open source home automation software focused on local control and privacy
• CVE-2026-74975 MEDIUM 5.4 UPGRADE Spoofing issue in the Downloads component in Firefox for Android
• CVE-2026-0292 MEDIUM 6.0 UPGRADE An authentication bypass vulnerability in the network driver of Palo Alto Networks Prisma® Access Agent on Win
• CVE-2026-11319 MEDIUM 6.2 TickTick Android application (com.ticktick.task) 8.2.2.0 contains a path traversal vulnerability in its export
• CVE-2026-0293 MEDIUM 6.0 UPGRADE A vulnerability in Palo Alto Networks Prisma® Access Agent on Windows enables a local attacker with administra
• CVE-2026-17872 MEDIUM 6.1 UPGRADE Cryptographic Flaw in WebAppInstalls in Google Chrome on Android prior to 151.0.7922.72 allowed a local attack
• CVE-2026-17891 MEDIUM 5.8 UPGRADE Use after free in ANGLE in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had c
• CVE-2026-18853 MEDIUM 5.3 A security vulnerability has been detected in ZomboDroid Meme Generator App 4.6830 on Android
• CVE-2026-70639 MEDIUM 5.5 UPGRADE llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI
• CVE-2026-17737 MEDIUM 5.0 UPGRADE Use after free in Bluetooth in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who h
• CVE-2026-17808 MEDIUM 4.3 UPGRADE Uninitialized Use in WebGL in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to lea
• CVE-2026-17949 MEDIUM 4.3 UPGRADE Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to leak
• CVE-2026-21064 MEDIUM 5.5 MITIGATE Improper access control in Weaver prior to SMR Aug-2026 Release 1 allows local attackers to cause device inope
• CVE-2026-44965 MEDIUM 5.5 In versions of the Datadog Android application prior to v545-5.9.2, six App Widget configuration activities (I
• CVE-2026-47362 MEDIUM 4.6 In versions of the Datadog Android application prior to v554-5.9.4, two Room-backed SQLite databases store sen
• CVE-2026-17767 MEDIUM 4.3 UPGRADE Insufficient validation of untrusted input in WebView in Google Chrome on Android prior to 151.0.7922.72 allow
• CVE-2026-17794 MEDIUM 4.3 UPGRADE Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowe
• CVE-2026-17802 MEDIUM 4.3 UPGRADE Side-channel information leakage in GPU in Google Chrome on Android prior to 151.0.7922.72 allowed a remote at
• CVE-2026-17938 MEDIUM 4.3 UPGRADE Inappropriate implementation in FullScreen in Google Chrome on Android prior to 151.0.7922.72 allowed a remote
• CVE-2026-17961 MEDIUM 4.3 UPGRADE Inappropriate implementation in Session in Google Chrome on Android prior to 151.0.7922.72 allowed a remote at
• CVE-2026-17964 MEDIUM 4.3 UPGRADE Incorrect security UI in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to pe
• CVE-2026-17994 MEDIUM 4.3 UPGRADE Inappropriate implementation in Media in Google Chrome on Android prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-18007 MEDIUM 4.3 UPGRADE Inappropriate implementation in Input in Google Chrome on Android prior to 151.0.7922.72 allowed a remote atta
• CVE-2026-18604 MEDIUM 5.3 A vulnerability was identified in textPlus Text Message and Call App up to 8.3.5 on Android
• CVE-2026-21060 MEDIUM 4.6 MITIGATE Improper input validation in Samsung Contacts prior to SMR Aug-2026 Release 1 allows physical attackers to acc
• CVE-2026-21070 MEDIUM 4.6 MITIGATE Improper input validation in Samsung Message prior to SMR Aug-2026 Release 1 allows physical attackers to acce
• CVE-2026-34490 MEDIUM 5.5 UPGRADE Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allow
• CVE-2026-17731 MEDIUM 4.3 UPGRADE Inappropriate implementation in Autofill in Google Chrome on Android prior to 151.0.7922.72 allowed a remote a
• CVE-2026-17733 MEDIUM 4.3 UPGRADE Inappropriate implementation in QUIC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attac
• CVE-2026-17747 MEDIUM 4.2 UPGRADE Insufficient validation of untrusted input in Payments in Google Chrome on Android prior to 151.0.7922.72 allo
• CVE-2026-17901 MEDIUM 4.3 UPGRADE Insufficient validation of untrusted input in Sharing in Google Chrome on Android prior to 151.0.7922.72 allow
• CVE-2026-17904 MEDIUM 4.3 UPGRADE Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote att
• CVE-2026-17910 MEDIUM 4.3 UPGRADE Insufficient policy enforcement in NFC in Google Chrome on Android prior to 151.0.7922.72 allowed a remote att
• CVE-2026-21081 MEDIUM 5.1 Improper export of android application components in SamsungPassAutofill prior to version 5.2.10.x allows loca
• CVE-2026-17925 MEDIUM 4.3 UPGRADE Inappropriate implementation in Cast in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attac
• CVE-2026-68927 LOW 3.0 MobSF is a mobile application security testing tool used
• CVE-2026-0291 MEDIUM 4.4 UPGRADE An improper link resolution before file access vulnerability exists in the Palo Alto Networks Prisma® Access A
• CVE-2026-17980 LOW 3.1 UPGRADE Inappropriate implementation in UI in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacke
• CVE-2026-18000 LOW 3.1 UPGRADE Insufficient policy enforcement in USB in Google Chrome on Android prior to 151.0.7922.72 allowed a remote att
• CVE-2026-17766 LOW 3.3 UPGRADE Insufficient validation of untrusted input in Clipboard in Google Chrome on Android prior to 151.0.7922.72 all
• CVE-2026-17860 LOW 3.3 UPGRADE Insufficient validation of untrusted input in Mobile in Google Chrome on Android prior to 151.0.7922.72 allowe
• CVE-2026-17984 LOW 3.3 UPGRADE Inappropriate implementation in Browser in Google Chrome on Android prior to 151.0.7922.72 allowed a local att
• CVE-2026-21062 LOW 3.3 MITIGATE Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local attackers to access c
• CVE-2026-115724 LOW 2.9 VLC for Android before 3.7.2 contains a confused-deputy file overwrite vulnerability in FileUtils.getUri() tha

FAQ

How do I fix Android vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Android being exploited right now?

Yes: 1 Android CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.

Which Android CVE should I patch first?

CVE-2026-58704 currently ranks highest (68/100): Google Pixel Improper Authorization Vulnerability.

← Back to latest CVEs