Filtered by vendor Google Subscriptions
Total 13260 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2025-11716 2 Google, Mozilla 3 Android, Firefox, Thunderbird 2025-10-16 6.5 Medium
Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability affects Firefox < 144 and Thunderbird < 144.
CVE-2025-20721 2 Google, Mediatek 15 Android, Iot Yocto, Mt6886 and 12 more 2025-10-15 7.8 High
In imgsensor, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10089545; Issue ID: MSV-4279.
CVE-2025-20722 4 Google, Mediatek, Openwrt and 1 more 19 Android, Mt6835, Mt6878 and 16 more 2025-10-15 5.5 Medium
In gnss driver, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920036; Issue ID: MSV-3798.
CVE-2025-20723 2 Google, Mediatek 15 Android, Mt6835, Mt6878 and 12 more 2025-10-15 7.8 High
In gnss driver, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09920033; Issue ID: MSV-3797.
CVE-2025-55971 2 Google, Tcl 4 Android Tv, 65c655, 65c655 Firmware and 1 more 2025-10-15 4.7 Medium
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 (Android TV, Kernel 5.4.242+), is vulnerable to a blind, unauthenticated Server-Side Request Forgery (SSRF) vulnerability via the UPnP MediaRenderer service (AVTransport:1). The device accepts unauthenticated SetAVTransportURI SOAP requests over TCP/16398 and attempts to retrieve externally referenced URIs, including attacker-controlled payloads. The blind SSRF allows for sending requests on behalf of the TV, which can be leveraged to probe for other internal or external services accessible by the device (e.g., 127.0.0.1:16XXX, LAN services, or internet targets), potentially enabling additional exploit chains.
CVE-2025-11717 2 Google, Mozilla 2 Android, Firefox 2025-10-15 9.1 Critical
When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability affects Firefox < 144.
CVE-2025-11718 2 Google, Mozilla 2 Android, Firefox 2025-10-15 6.5 Medium
When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event This vulnerability affects Firefox < 144.
CVE-2025-11720 2 Google, Mozilla 2 Android, Firefox 2025-10-15 8.1 High
The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability affects Firefox < 144.
CVE-2025-59834 3 Adb Mcp Project, Google, Srmorete 3 Adb Mcp, Android, Adb Mcp Server 2025-10-14 9.8 Critical
ADB MCP Server is a MCP (Model Context Protocol) server for interacting with Android devices through ADB. In versions 0.1.0 and prior, the MCP Server is written in a way that is vulnerable to command injection vulnerability attacks as part of some of its MCP Server tool definition and implementation. This issue has been patched via commit 041729c.
CVE-2017-20202 2 Google, Web Developer For Chrome 2 Chrome, Web Developer For Chrome 2025-10-14 N/A
Web Developer for Chrome v0.4.9 contained malicious code that generated a domain via a DGA and fetched a remote script. The fetched script conditionally loaded follow-on modules that performed extensive ad substitution and malvertising, displayed fake “repair” alerts that redirected users to affiliate programs, and attempted to harvest credentials when users logged in. Injected components enumerate common banner sizes for substitution, replace third-party ad calls, and redirect victim traffic to affiliate landing pages. Potential impacts include user-level code execution in the browser context, large-scale ad fraud and traffic hijacking, credential theft, and exposure to additional payloads delivered by the actor. The compromise was reported on by the maintainer of Web Developer for Chrome on August 2, 2017 and remediated in v0.5.0.
CVE-2024-20854 2 Google, Samsung 2 Android, Camera 2025-10-10 5.9 Medium
Improper handling of insufficient privileges vulnerability in Samsung Camera prior to versions 12.1.0.31 in Android 12, 13.1.02.07 in Android 13, and 14.0.01.06 in Android 14 allows local attackers to access image data.
CVE-2025-5009 2 Apple, Google 2 Ios, Gemini 2025-10-09 N/A
In Gemini iOS, when a user shared a snippet of a conversation, it would share the entire conversation via a sharable public link that contained the entire conversation history and not just the snippet.
CVE-2025-34251 2 Google, Tesla 3 Android, Telematics Control Unit, Tesla 2025-10-08 N/A
Tesla Telematics Control Unit (TCU) firmware prior to v2025.14 contains an authentication bypass vulnerability. The TCU runs the Android Debug Bridge (adbd) as root and, despite a “lockdown” check that disables adb shell, still permits adb push/pull and adb forward. Because adbd is privileged and the device’s USB port is exposed externally, an attacker with physical access can write an arbitrary file to a writable location and then overwrite the kernel’s uevent_helper or /proc/sys/kernel/hotplug entries via ADB, causing the script to be executed with root privileges.
CVE-2025-56466 2 Google, Masterlifecrm 2 Android, Dietly 2025-10-06 7.5 High
Hardcoded credentials in Dietly v1.25.0 for android allows attackers to gain sensitive information.
CVE-2025-1122 1 Google 2 Chrome, Chrome Os 2025-10-06 6.7 Medium
Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 15753.50.0 stable on Cr50 Boards allows an attacker with root access to gain persistence and Bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.
CVE-2025-1292 1 Google 2 Chrome, Chrome Os 2025-10-06 6.7 Medium
Out-Of-Bounds Write in TPM2 Reference Library in Google ChromeOS 122.0.6261.132 stable on Cr50 Boards allows an attacker with root access to gain persistence and bypass operating system verification via exploiting the NV_Read functionality during the Challenge-Response process.
CVE-2025-55556 2 Google, Tensorflow 2 Tensorflow, Tensorflow 2025-10-03 6.5 Medium
TensorFlow v2.18.0 was discovered to output random results when compiling Embedding, leading to unexpected behavior in the application.
CVE-2025-55559 1 Google 1 Tensorflow 2025-10-03 7.5 High
An issue was discovered TensorFlow v2.18.0. A Denial of Service (DoS) occurs when padding is set to 'valid' in tf.keras.layers.Conv2D.
CVE-2025-6044 1 Google 1 Chrome Os 2025-10-03 6.1 Medium
An Improper Access Control vulnerability in the Stylus Tools component of Google ChromeOS version 16238.64.0 on the garaged stylus devices allows a physical attacker to bypass the lock screen and access user files by removing the stylus while the device is closed and using the screen capture feature.
CVE-2025-2509 1 Google 1 Chrome Os 2025-10-03 7.8 High
Out-of-Bounds Read in Virglrenderer in ChromeOS 16093.57.0 allows a malicious guest VM to achieve arbitrary address access within the crosvm sandboxed process, potentially leading to VM escape via crafted vertex elements data triggering an out-of-bounds read in util_format_description.