Android known exploited vulnerabilities
Every Android CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 17 in all, 3 added in the last 12 months.
- CVE-2025-48595In multiple locations, there is a possible way to achieve code execution due to an integer overflow.Google Android
- CVE-2025-48633In hasAccountsOnAnyUser of DevicePolicyManagerService.java, there is a possible way to add a Device Owner after provisioning due to a logic Google Android
- CVE-2025-48572In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass.Google Android
- CVE-2025-48543In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free.Google Android
- CVE-2024-43093In shouldHideDocument of ExternalStorageProvider.java, there is a possible bypass of a file path filter designed to prevent access to sensitGoogle Android
- CVE-2024-36971net: fix __dst_negative_advice() raceLinux
- CVE-2024-32896there is a possible way to bypass due to a logic error in the code.Google Android
- CVE-2024-29748there is a possible way to bypass due to a logic error in the code.Google Android
- CVE-2024-29745there is a possible Information Disclosure due to uninitialized data.Google Android
- CVE-2023-21237In applyRemoteView of NotificationContentInflater.java, there is a possible way to hide foreground service notification due to misleading orAndroid
- CVE-2023-35674In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code.Google Android
- CVE-2023-20963In WorkSource, there is a possible parcel mismatch.Android
- CVE-2011-1823The vold volume manager daemon on Android 3.0 and 2.x before 2.3.4 trusts messages that are received from a PF_NETLINK socket, which allows
- CVE-2021-1048In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free.Android
- CVE-2021-0920In unix_scm_to_skb of af_unix.c, there is a possible use after free bug due to a race condition.Android
- CVE-2020-0041In binder_transaction of binder.c, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2019-2215A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel.Android
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
How many Android vulnerabilities are in CISA KEV?
17 Android vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 3 of them added in the last 12 months. The newest is CVE-2025-48595 (Android Framework Integer Overflow Vulnerability), added 2026-06-02.
Which Android products are in CISA KEV?
6 products, including Framework, Runtime, Kernel. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Android KEV vulnerabilities used by ransomware?
CISA has no known ransomware use on record for Android's KEV entries.