Filtered by vendor Google Subscriptions
Filtered by product Android Subscriptions
Total 9072 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-11718 2 Google, Mozilla 2 Android, Firefox 2026-04-20 6.5 Medium
When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event. This vulnerability was fixed in Firefox 144.
CVE-2025-6428 2 Google, Mozilla 2 Android, Firefox 2026-04-20 4.3 Medium
When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
CVE-2025-6431 2 Google, Mozilla 2 Android, Firefox 2026-04-20 6.5 Medium
When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. *This bug only affects Firefox for Android. Other versions of Firefox are unaffected.*. This vulnerability was fixed in Firefox 140.
CVE-2025-9186 2 Google, Mozilla 2 Android, Firefox 2026-04-20 6.5 Medium
Spoofing issue in the Address Bar component of Firefox Focus for Android. This vulnerability was fixed in Firefox 142.
CVE-2025-8042 2 Google, Mozilla 2 Android, Firefox 2026-04-20 9.8 Critical
Firefox for Android allowed a sandboxed iframe without the `allow-downloads` attribute to start downloads. This vulnerability was fixed in Firefox 141.
CVE-2025-8364 2 Google, Mozilla 2 Android, Firefox 2026-04-20 4.3 Medium
A crafted URL using a blob: URI could have hidden the true origin of the page, resulting in a potential spoofing attack. *Note: This issue only affected Android operating systems. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 141.
CVE-2026-0017 1 Google 1 Android 2026-04-18 7.7 High
In onChange of BiometricService.java, there is a possible way to enable fingerprint unlock due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-22694 2 Aliasvault, Google 2 Aliasvault, Android 2026-04-18 6.1 Medium
AliasVault is a privacy-first password manager with built-in email aliasing. AliasVault Android versions 0.24.0 through 0.25.2 contained an issue in how passkey requests from Android apps were validated. Under certain local conditions, a malicious app could attempt to obtain a passkey response for a site it was not authorized to access. The issue involved incomplete validation of calling app identity, origin, and RP ID in the Android credential provider. This issue was fixed in AliasVault Android 0.25.3.
CVE-2026-0901 4 Apple, Google, Linux and 1 more 5 Macos, Android, Chrome and 2 more 2026-04-18 5.4 Medium
Inappropriate implementation in Blink in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: High)
CVE-2026-20415 2 Google, Mediatek 3 Android, Mt6897, Mt6989 2026-04-18 5.5 Medium
In imgsys, there is a possible memory corruption due to improper locking. This could lead to local denial of service if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10363254; Issue ID: MSV-5617.
CVE-2026-0011 1 Google 1 Android 2026-04-18 8.4 High
In enableSystemPackageLPw of Settings.java, there is a possible way to prevent location access from working due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0025 1 Google 1 Android 2026-04-18 8.4 High
In hasImage of Notification.java, there is a possible way to reveal information across users due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0027 1 Google 1 Android 2026-04-18 6.7 Medium
In smmu_detach_dev of arm-smmu-v3.c, there is a possible out of bounds write due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-20972 2 Google, Samsung 4 Android, Android, Mobile and 1 more 2026-04-18 3.3 Low
Improper Export of Android Application Components in UwbTest prior to SMR Jan-2026 Release 1 allows local attackers to enable UWB.
CVE-2026-0906 4 Apple, Google, Linux and 1 more 5 Macos, Android, Chrome and 2 more 2026-04-18 9.8 Critical
Incorrect security UI in Google Chrome on Android prior to 144.0.7559.59 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Low)
CVE-2026-20414 2 Google, Mediatek 9 Android, Mt6897, Mt6989 and 6 more 2026-04-18 6.7 Medium
In imgsys, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10362999; Issue ID: MSV-5625.
CVE-2026-0106 1 Google 1 Android 2026-04-18 9.3 Critical
In vpu_mmap of vpu_ioctl, there is a possible arbitrary address mmap due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0028 1 Google 1 Android 2026-04-17 8.4 High
In __pkvm_host_share_guest of mem_protect.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0035 1 Google 1 Android 2026-04-17 8.4 High
In createRequest of MediaProvider.java, there is a possible way for an app to gain read/write access to non-existing files due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
CVE-2026-0037 1 Google 1 Android 2026-04-17 8.4 High
In multiple functions of ffa.c, there is a possible memory corruption due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.