Android
9,384 CVEs tracked. 39 of them are in CISA KEV.
This hub aggregates every CVE we track for Android, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Android CVEs per month
| Month | CVEs |
|---|---|
| 2024-12 | 58 |
| 2025-01 | 84 |
| 2025-02 | 42 |
| 2025-03 | 17 |
| 2025-04 | 17 |
| 2025-05 | 21 |
| 2025-06 | 12 |
| 2025-07 | 15 |
| 2025-08 | 34 |
| 2025-09 | 190 |
| 2025-10 | 14 |
| 2025-11 | 15 |
| 2025-12 | 116 |
| 2026-01 | 32 |
| 2026-02 | 16 |
| 2026-03 | 107 |
| 2026-04 | 11 |
| 2026-05 | 13 |
| 2026-06 | 127 |
| 2026-07 | 0 |
| 2026-08 | 18 |
| 2026-09 | 206 |
| 2026-10 | 34 |
| 2026-11 | 138 |
Severity
How the 9,384 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical795
- High4,069
- Medium4,242
- Low277
Latest CVEs
The 15 most recently published vulnerabilities affecting Android.
- CVE-2026-58977In is_valid_header of timed_cache_item.c, there is a possible out-of-bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges ne...6.7
- CVE-2026-58930An unprivileged application can exploit a lack of package/signature validation in SystemUI's `RemoteQCController` when resolving a hardcoded `content://` URI. This allows the attacker to squat on a...7.8
- CVE-2026-58927The vulnerability is a Use-After-Free (UAF) in the EVS AIDL HAL, arising from a data race on an unsynchronized `std::weak_ptr` within `EvsEnumerator::openCamera()`. Specifically, concurrent calls f...6.7
- CVE-2026-58926A Use-After-Free (UAF) vulnerability exists in the EVS HAL, allowing a privileged client to free a `buffer_handle_t` while the producer thread is still using it. This race condition, triggered via ...2.5
- CVE-2026-58925The report details a heap Use-After-Free (UAF) vulnerability within the `android.hardware.automotive.evs-default` HAL service, stemming from unsynchronized access to an `std::unordered_map`. An unp...7.8
- CVE-2026-58924The vulnerability is a heap out-of-bounds read in the EVS HAL's `getStreamList()` method. An attacker can craft a `CameraDesc.metadata` byte array, which is parsed without validation, leading to an...7.5
- CVE-2026-58915A physical occupant on an Android Automotive OS (AAOS) Multi-User Multi-Display (MUMD) passenger display can view sensitive Heads-Up Notification (HUN) content and execute actions for a secure pass...6.1
- CVE-2026-49906An unprivileged application can bypass the `android.car.permission.CAR_DISPLAY_IN_CLUSTER` permission by registering an activity with the `android.car.cluster.NAVIGATION` category and requesting na...7.8
- CVE-2026-49903The `ClusterRenderingService.dump()` method, accessible to processes holding `android.permission.DUMP` and `android.permission.PACKAGE_USAGE_STATS`, acts as a confused deputy. It allows attackers t...5.3
- CVE-2026-59048In rb_cpu_init of trace.c, there is a possible out-of-bounds read due to an incorrect bounds check. This could lead to local information disclosure with no additional execution privileges needed. U...5.5
- CVE-2026-59047In multiple locations, there is a possible denial of service due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User intera...6.2
- CVE-2026-59046In __pkvm_guest_relinquish_to_host of mem_protect.c, there is a possible out-of-bounds write due to improper input validation. This could lead to local denial of service with no additional executio...6.2
- CVE-2026-59045In multiple locations, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti...7.4
- CVE-2026-59044In multiple locations, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User int...8.4
- CVE-2026-59043In arm_lpae_split_blk_unmap of io-pgtable-arm-common.c, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with no additional execution ...7.4
Product grouping is registry-driven, with AI assist and human review. How it works