Security releases, BugRater

Google CVE-2026-58977

In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privileg

0 CVEs and 0 credit lines.

Google CVE-2026-58930

An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. T

0 CVEs and 0 credit lines.

Google CVE-2026-58927

The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera

0 CVEs and 0 credit lines.

Google CVE-2026-58926

A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it

0 CVEs and 0 credit lines.

Google CVE-2026-58925

The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized acce

0 CVEs and 0 credit lines.

Google CVE-2026-58924

The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is par

0 CVEs and 0 credit lines.

Google CVE-2026-58915

A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content

0 CVEs and 0 credit lines.

Google CVE-2026-58873

In addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalatio

0 CVEs and 0 credit lines.

Google CVE-2026-49906

An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.N

0 CVEs and 0 credit lines.

Google CVE-2026-49903

The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a c

0 CVEs and 0 credit lines.

Google CVE-2026-59048

In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no addi

0 CVEs and 0 credit lines.

Google CVE-2026-59047

In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional exe

0 CVEs and 0 credit lines.

Google CVE-2026-59046

In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial o

0 CVEs and 0 credit lines.

Google CVE-2026-59045

In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execut

0 CVEs and 0 credit lines.

Google CVE-2026-59044

In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional

0 CVEs and 0 credit lines.

Google CVE-2026-59043

In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of pr

0 CVEs and 0 credit lines.

Google CVE-2026-59042

In __pkvm_pages_to_ppages of mmu.c, there is a possible out-of-bounds write due to a race condition. This could lead to local escalation of privilege with no ad

0 CVEs and 0 credit lines.

Google CVE-2026-59031

In InputDispatcher::flushSensor of InputDispatcher.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial

0 CVEs and 0 credit lines.

Google CVE-2026-59028

In resolveAidConflictLocked of RegisteredAidCache.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of p

0 CVEs and 0 credit lines.

Google CVE-2026-59022

In multiple functions of MediaProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclo

0 CVEs and 0 credit lines.

Google CVE-2026-59021

In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with User execution pr

0 CVEs and 0 credit lines.

Google CVE-2026-59020

In removeUserData of DevicePolicyManagerService.java, there is a possible denial of service due to a race condition. This could lead to local denial of service

0 CVEs and 0 credit lines.

Google CVE-2026-59016

In sendAnomalyProfile of ProfilingService.java, there is a possible path traversal issue due to path traversal. This could lead to local escalation of privilege

0 CVEs and 0 credit lines.

Google CVE-2026-59015

In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local information disclosure with no additional execut

0 CVEs and 0 credit lines.

Google CVE-2026-59014

In multiple locations, there is a possible out-of-bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional e

0 CVEs and 0 credit lines.

Google CVE-2026-59012

In checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible permission bypass due to a missing permission check. This could lead t

0 CVEs and 0 credit lines.

Google CVE-2026-59011

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to local information disclosure with no additiona

0 CVEs and 0 credit lines.

Google CVE-2026-59010

In deserialize of legacy.rs, there is a possible denial of service due to a missing bounds check. This could lead to local denial of service with no additional

0 CVEs and 0 credit lines.

Google CVE-2026-59008

In setApplicationRestrictions of DevicePolicyManagerService.java, there is a possible denial of service due to resource exhaustion. This could lead to local den

0 CVEs and 0 credit lines.

Google CVE-2026-59007

In decode_packed_entry_number of codebook.c, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disc

0 CVEs and 0 credit lines.

Google CVE-2026-59006

In getTouchOcclusionMode of WindowState.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local information disc

0 CVEs and 0 credit lines.

Google CVE-2026-59005

In insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a missing permission check. This could lead to local escalation of p

0 CVEs and 0 credit lines.

Google CVE-2026-59004

In multiple locations, there is a possible permission bypass due to an uncaught exception. This could lead to local escalation of privilege with no additional e

0 CVEs and 0 credit lines.

Google CVE-2026-59003

In getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information disclosure due to a missing permission check. This could lead to

0 CVEs and 0 credit lines.

Google CVE-2026-59002

In handleMessage of UsbDeviceManager.java, there is a possible lock-screen bypass due to a logic error in the code. This could lead to physical information disc

0 CVEs and 0 credit lines.

Google CVE-2026-59001

In checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a logic error in the code. This could lead to local information

0 CVEs and 0 credit lines.

Google CVE-2026-59000

In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execu

0 CVEs and 0 credit lines.

Google CVE-2026-58997

In validateImageInfo of Bitmap.cpp, there is a possible out-of-bounds read due to a precondition check failure. This could lead to local information disclosure

0 CVEs and 0 credit lines.

Google CVE-2026-58995

In getEntryFileName of ZipFileRO.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of privilege wi

0 CVEs and 0 credit lines.

Google CVE-2026-58994

In multiple functions of NfcService.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privil

0 CVEs and 0 credit lines.

Google CVE-2026-58990

In l2c_fcr_process_peer_cfg_req of l2c_fcr.cc, there is a possible memory safety issue due to an integer overflow. This could lead to remote information disclos

0 CVEs and 0 credit lines.

Google CVE-2026-58989

In setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local escalatio

0 CVEs and 0 credit lines.

Google CVE-2026-58988

In isValid of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no a

0 CVEs and 0 credit lines.

Google CVE-2026-58986

In notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to

0 CVEs and 0 credit lines.

Google CVE-2026-58985

In handleConnectInternal of RpcServerTrusty.cpp, there is a possible denial of service due to a logic error in the code. This could lead to local denial of serv

0 CVEs and 0 credit lines.

Google CVE-2026-58984

In multiple locations, there is a possible memory corruption due to a use-after-free. This could lead to local escalation of privilege with no additional execut

0 CVEs and 0 credit lines.

Google CVE-2026-58979

In canPresent of PresentationController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of pri

0 CVEs and 0 credit lines.

Google CVE-2026-58978

In multiple locations, there is a possible permission bypass due to a logic error in the code. This could lead to physical escalation of privilege with no addit

0 CVEs and 0 credit lines.

Google CVE-2026-58976

In getSelectionBySubIds of ProviderUtil.java, there is a possible cross-user data leak due to a logic error in the code. This could lead to local information di

0 CVEs and 0 credit lines.

Google CVE-2026-58975

In multiple locations, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additiona

0 CVEs and 0 credit lines.

Google CVE-2026-58974

In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additio

0 CVEs and 0 credit lines.

Google CVE-2026-58971

In _mupdf_get_hdr of wprint_mupdf.c, there is a possible out-of-bounds read due to an integer overflow. This could lead to local information disclosure with no

0 CVEs and 0 credit lines.

Google CVE-2026-58970

In deliverResult of AppTimeTracker.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privile

0 CVEs and 0 credit lines.

Google CVE-2026-58969

In multiple functions of MediaQualityService.java, there is a possible permission bypass due to a missing permission check. This could lead to local information

0 CVEs and 0 credit lines.

Google CVE-2026-58968

In oapvd_vlc_metadata of oapv_vlc.c, there is a possible memory corruption due to a double free. This could lead to remote escalation of privilege with no addit

0 CVEs and 0 credit lines.

Google CVE-2026-58966

In multiple functions of hppsfilter.c, there is a possible out-of-bounds write due to a stack buffer overflow. This could lead to local escalation of privilege

0 CVEs and 0 credit lines.

Google CVE-2026-58965

In handleAudioEffectBroadcast of MusicFxHelper.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of priv

0 CVEs and 0 credit lines.

Google CVE-2026-58964

In checkDestination of SmsUsageMonitor.java, there is a possible permission bypass due to improper input validation. This could lead to local escalation of priv

0 CVEs and 0 credit lines.

Google CVE-2026-58963

In multiple locations, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no additional ex

0 CVEs and 0 credit lines.

Google CVE-2026-58962

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible permission bypass due to a missing permission check. This could lead to local e

0 CVEs and 0 credit lines.

Google CVE-2026-58961

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background activity launch due to a logic error in the code. This could lead to

0 CVEs and 0 credit lines.

Google CVE-2026-58957

In resolveToHeavyWeightSwitcherIfNeeded of ActivityStarter.java, there is a possible background activity launch due to a confused deputy. This could lead to loc

0 CVEs and 0 credit lines.

Google CVE-2026-58956

In modpowF4 of avb_rsa.c, there is a possible signature verification bypass due to a logic error in the code. This could lead to local escalation of privilege w

0 CVEs and 0 credit lines.

Google CVE-2026-58955

In updateNotificationChannel of PreferencesHelper.java, there is a possible ui obfuscation issue due to a logic error in the code. This could lead to local deni

0 CVEs and 0 credit lines.

Google CVE-2026-58953

In dec_vlc_read of oapv_vlc.c, there is a possible out-of-bounds read due to a heap buffer overflow. This could lead to remote information disclosure with no ad

0 CVEs and 0 credit lines.

Google CVE-2026-58951

In multiple locations, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with no addition

0 CVEs and 0 credit lines.

Google CVE-2026-58949

In parseMetaData of StagefrightMetadataRetriever.cpp, there is a possible denial of service due to a stack buffer overflow. This could lead to remote denial of

0 CVEs and 0 credit lines.

Google CVE-2026-58946

In navigateUpTo of ActivityClientController.java, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of

0 CVEs and 0 credit lines.

Google CVE-2026-58945

In multiple locations, there is a possible side channel information leak due to improperly used crypto. This could lead to paired device information disclosure

0 CVEs and 0 credit lines.

Google CVE-2026-58944

In moveTaskToFrontLocked of ActivityTaskManagerService.java, there is a possible background application launch (bal) issue due to a confused deputy. This could

0 CVEs and 0 credit lines.

Google CVE-2026-58943

In run of AddAccountSettings.java, there is a possible background activity launch due to a confused deputy. This could lead to local escalation of privilege wit

0 CVEs and 0 credit lines.

Google CVE-2026-58942

In do_fault_around of memory.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no ad

0 CVEs and 0 credit lines.

Google CVE-2026-58938

In parseChunk of MPEG4Extractor.cpp, there is a possible denial of service due to improper input validation. This could lead to remote denial of service with no

0 CVEs and 0 credit lines.

Google CVE-2026-58937

In multiple locations, there is a possible persistent denial of service due to improper input validation. This could lead to local denial of service with no add

0 CVEs and 0 credit lines.

Google CVE-2026-58936

In png_set_tRNS of pngset.c, there is a possible memory corruption due to a use-after-free. This could lead to remote code execution with no additional executio

0 CVEs and 0 credit lines.

Google CVE-2026-58934

In prepareWindowToDisplayDuringRelayout of WindowState.java, there is a possible permission bypass due to a logic error in the code. This could lead to local es

0 CVEs and 0 credit lines.

Google CVE-2026-58933

In process of C2SoftApvDec.cpp, there is a possible out-of-bounds read due to a logic error in the code. This could lead to remote information disclosure with n

0 CVEs and 0 credit lines.

Google CVE-2026-58886

In updateInputWindows of InputMonitor.java, there is a possible tapjacking issue due to a logic error in the code. This could lead to local escalation of privil

0 CVEs and 0 credit lines.

Google CVE-2026-58885

In multiple locations, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege with no additional execu

0 CVEs and 0 credit lines.

Google CVE-2026-58884

In startTetheredHotspotRequest of WifiServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of p

0 CVEs and 0 credit lines.

Google CVE-2026-58883

In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to remote denial of service with no additional ex

0 CVEs and 0 credit lines.

Google CVE-2026-58882

In decodeWapPdu of WapPushOverSms.java, there is a possible out of bounds read due to an integer overflow. This could lead to a remote denial of service with no

0 CVEs and 0 credit lines.

Google CVE-2026-58879

In descramble of multiple files, there is a possible out-of-bounds write due to improper casting. This could lead to local escalation of privilege with no addit

0 CVEs and 0 credit lines.

Google CVE-2026-58877

In checkNearbyDevicesPermission of WifiP2pServiceImpl.java, there is a possible permission bypass due to a confused deputy. This could lead to local information

0 CVEs and 0 credit lines.

Google CVE-2026-58876

In multiple locations, there is a possible memory safety issue due to a use-after-free. This could lead to remote code execution with no additional execution pr

0 CVEs and 0 credit lines.

Google CVE-2026-58875

In multiple locations, there is a possible denial of service due to improper input validation. This could lead to local denial of service with no additional exe

0 CVEs and 0 credit lines.

Google CVE-2026-58871

In set_type4_frame_classifier of sta_iface.cpp, there is a possible memory safety issue due to a heap buffer overflow. This could lead to local escalation of pr

0 CVEs and 0 credit lines.

Google CVE-2026-58870

In onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local infor

0 CVEs and 0 credit lines.

Google CVE-2026-58868

In onOutputReceived of FrameDecoder.cpp, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no

0 CVEs and 0 credit lines.

Google CVE-2026-58867

In getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of priv

0 CVEs and 0 credit lines.

Google CVE-2026-58866

In setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible untrusted/misleading UI issue due to a missing permission check. Thi

0 CVEs and 0 credit lines.

Google CVE-2026-58857

In decrypt of CryptoHalHidl.cpp, there is a possible use-after-free due to a race condition. This could lead to remote code execution with no additional executi

0 CVEs and 0 credit lines.

Google CVE-2026-58853

In multiple functions of ipphelper.c, there is a possible stack bugger overflow due to a missing bounds check. This could lead to remote denial of service with

0 CVEs and 0 credit lines.

Google CVE-2026-58847

In kvm_vfio_pviommu_attach of vfio.c, there is a possible double free due to a logic error in the code. This could lead to local escalation of privilege with no

0 CVEs and 0 credit lines.

Google CVE-2026-58845

In multiple locations, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional e

0 CVEs and 0 credit lines.

Google CVE-2026-58844

In multiple locations, there is a possible out of bounds read/write due to an incorrect bounds check. This could lead to local escalation of privilege with no a

0 CVEs and 0 credit lines.

Google CVE-2026-58838

In multiple functions of Helpers.java, there is a possible information disclosure due to improper input validation. This could lead to local information disclos

0 CVEs and 0 credit lines.

Google CVE-2026-58837

In multiple locations, there is a possible background activity launch due to a logic error in the code. This could lead to local escalation of privilege with no

0 CVEs and 0 credit lines.

Google CVE-2026-58836

In handlePackagePostInstall of InstallPackageHelper.java, there is a possible Enhanced Confirmation Mode (ECM) bypass vulnerability that allows a sideloaded app

0 CVEs and 0 credit lines.

Google CVE-2026-58829

In fuse_backing_mmap of backing.c, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with no addit

0 CVEs and 0 credit lines.

Researcher credits in vendor advisories

Vendor