# cve.now: Google

The newest entries naming Google as an affected vendor (up to 200), of 9,028 in all, 82 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-95405](https://cve.now/CVE-2026-95405.md): In acquireMemory of bt\_bqr\_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an… (no CVSS)
- [CVE-2026-95404](https://cve.now/CVE-2026-95404.md): In multiple locations, there is a possible way to modify coprocessor instruction and data memory from non-secure software due to an… (CVSS 6.7)
- [CVE-2026-95403](https://cve.now/CVE-2026-95403.md): In multiple locations, there is a possible way to trigger an out of bounds write in the shared memory tracking bitmap due to a missing… (no CVSS)
- [CVE-2026-95402](https://cve.now/CVE-2026-95402.md): In slice\_header of hevc\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-95401](https://cve.now/CVE-2026-95401.md): In knee\_function\_info of hevc\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-95400](https://cve.now/CVE-2026-95400.md): In StNfc\_hal\_write of hal\_st21nfc.cc, there is a possible way to trigger an out of bounds write into global memory due to an incorrect… (no CVSS)
- [CVE-2026-95399](https://cve.now/CVE-2026-95399.md): In multiple functions of face\_status.h, there is a possible way to modify verified biometric enrollment data in shared memory due to a… (no CVSS)
- [CVE-2026-95397](https://cve.now/CVE-2026-95397.md): In sub\_layer\_hrd\_parameters of hevc\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-59637](https://cve.now/CVE-2026-59637.md): In userdata\_report of hwcodec\_firmware, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-59636](https://cve.now/CVE-2026-59636.md): In has\_booted\_successfully of sys\_state\_setup\_otp\_ta.c, there is a possible way to trigger a permanent denial of service via premature… (no CVSS)
- [CVE-2026-59635](https://cve.now/CVE-2026-59635.md): In cpb\_cnt of avc\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-59632](https://cve.now/CVE-2026-59632.md): In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via an undrained message queue… (CVSS 7.5)
- [CVE-2026-59631](https://cve.now/CVE-2026-59631.md): In s\_inter\_rps\_pred of hevc\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-59630](https://cve.now/CVE-2026-59630.md): In check\_constraint\_monotonicity of lib.rs, there is a possible way to downgrade stored security policies and bypass rollback protection… (no CVSS)
- [CVE-2026-59628](https://cve.now/CVE-2026-59628.md): In s\_copy\_host\_apb\_param of multiple files, there is a possible way to trigger an out of bounds read in the video decoder command queue… (no CVSS)
- [CVE-2026-59626](https://cve.now/CVE-2026-59626.md): In SendInfo of UssiController.cpp, there is a possible way to corrupt memory via a dangling connection listener pointer due to a use after… (no CVSS)
- [CVE-2026-59625](https://cve.now/CVE-2026-59625.md): In GetTwiddledMiptreeSparsePageMap of texmgmt.c, there is a possible way to trigger an out of bounds write due to a logic error. (no CVSS)
- [CVE-2026-59624](https://cve.now/CVE-2026-59624.md): In multiple locations, there is a possible way to trigger an out of bounds read via direct memory access in video decoder firmware due to… (no CVSS)
- [CVE-2026-59623](https://cve.now/CVE-2026-59623.md): In CompareTelUris of SipAddress.cpp, there is a possible way to trigger an unhandled out of range exception and process crash due to an… (CVSS 7.5)
- [CVE-2026-59619](https://cve.now/CVE-2026-59619.md): In getCodecQp of GC2AV1Enc.cpp, there is a possible way to trigger an out of bounds read during quantization table lookup due to a missing… (no CVSS)
- [CVE-2026-59618](https://cve.now/CVE-2026-59618.md): In smfc\_v4l2\_s\_selection of smfc-v4l2-ioctls.c, there is a possible way to trigger an out of bounds read from adjacent shared memory… (no CVSS)
- [CVE-2026-59616](https://cve.now/CVE-2026-59616.md): In prev\_run\_vcore of hwcodec\_firmware, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-59614](https://cve.now/CVE-2026-59614.md): In multiple functions of oem\_svc\_setup.c, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a… (no CVSS)
- [CVE-2026-59613](https://cve.now/CVE-2026-59613.md): In multiple locations, there is a possible way to trigger an out of bounds read and temporary denial of service due to improper input… (CVSS 7.5)
- [CVE-2026-59612](https://cve.now/CVE-2026-59612.md): In buffering\_period of avc\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-59611](https://cve.now/CVE-2026-59611.md): In multiple locations, there is a possible way to trigger a temporary denial of service via an integer overflow trap due to improper input… (CVSS 7.5)
- [CVE-2026-59609](https://cve.now/CVE-2026-59609.md): In fence\_manager\_extract\_iif of fence\_manager.c, there is a possible way to corrupt kernel memory via fence identifier reuse due to a use… (no CVSS)
- [CVE-2026-59608](https://cve.now/CVE-2026-59608.md): In tone\_mapping\_info of hevc\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-59607](https://cve.now/CVE-2026-59607.md): In TzPipelineInputExtractor of TzPipelineInputExtractor.cpp, there is a possible Logic check bypass due to a logic error in the code. (no CVSS)
- [CVE-2026-59606](https://cve.now/CVE-2026-59606.md): In multiple functions of sswrp\_cpm.dtsi, there is a possible way to modify global reset registers from non-secure software due to a… (no CVSS)
- [CVE-2026-59604](https://cve.now/CVE-2026-59604.md): In multiple locations, there is a possible way to trigger an unbounded loop in video decoder firmware due to a logic error. (no CVSS)
- [CVE-2026-59603](https://cve.now/CVE-2026-59603.md): In RespondReceivedMessage of MtsMessageController.cpp, there is a possible way to trigger a double free and process abort during message… (CVSS 7.5)
- [CVE-2026-59601](https://cve.now/CVE-2026-59601.md): In CalculateSampleRate of cldma\_alcedo.cc, there is a possible Heap Buffer Overflow due to a logic error in the code. (no CVSS)
- [CVE-2026-59599](https://cve.now/CVE-2026-59599.md): Android on supported Pixel devices before security patch level 2026-11-05 allows elevation of privilege in the hypervisor subcomponent in… (no CVSS)
- [CVE-2026-59598](https://cve.now/CVE-2026-59598.md): In platform\_rio\_ncp\_wdt\_handler of edgetpu\_rio.c, there is a possible Use After Free due to a use after free. (no CVSS)
- [CVE-2026-59597](https://cve.now/CVE-2026-59597.md): In bindDataService of DataServiceManager.java, there is a possible way to retain privileged tunnel management permissions across… (no CVSS)
- [CVE-2026-59596](https://cve.now/CVE-2026-59596.md): In multiple functions of mpu.c, there is a possible way to execute code from non-secure memory in the security coprocessor due to an… (no CVSS)
- [CVE-2026-59595](https://cve.now/CVE-2026-59595.md): In DecodeHeaderComponent of SipStack.cpp, there is a possible way to trigger stack exhaustion via unbounded mutual recursion due to a… (CVSS 7.5)
- [CVE-2026-59594](https://cve.now/CVE-2026-59594.md): In spm\_alloc of encoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. (no CVSS)
- [CVE-2026-59593](https://cve.now/CVE-2026-59593.md): In tile\_info of av1\_decoder, there is a possible Heap Buffer Overflow due to a heap buffer overflow. (no CVSS)
- [CVE-2026-59589](https://cve.now/CVE-2026-59589.md): In s\_av1\_dec\_metadata\_scalability of av1\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-59587](https://cve.now/CVE-2026-59587.md): In stpropnci\_prop\_st\_build\_set\_custom\_polling\_cmd of stpropnci\_prop\_st.cc, there is a possible way to trigger an out of bounds write into… (no CVSS)
- [CVE-2026-59586](https://cve.now/CVE-2026-59586.md): In multiple locations, there is a possible way to recover cryptographic keys and forge authentication tags due to improperly used crypto. (no CVSS)
- [CVE-2026-59585](https://cve.now/CVE-2026-59585.md): In SetDisplayName of RegInfoContact.cpp, there is a possible denial of service due to a missing null check. (CVSS 7.5)
- [CVE-2026-59583](https://cve.now/CVE-2026-59583.md): In FormCredentials of SipAuHelper.cpp, there is a possible way to disclose authentication credentials in cleartext via a scheme downgrade… (no CVSS)
- [CVE-2026-59582](https://cve.now/CVE-2026-59582.md): In StartTimer of UcePublishManager.cpp, there is a possible way to trigger a process abort during timer calculation due to an integer… (CVSS 7.5)
- [CVE-2026-59580](https://cve.now/CVE-2026-59580.md): In trusty\_context\_switch of services/spd/trusty/trusty.c, there is a possible Secure world register state leak due to a logic error in the… (no CVSS)
- [CVE-2026-59579](https://cve.now/CVE-2026-59579.md): In getUserDataPayload of GC2UserData.cpp, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-59578](https://cve.now/CVE-2026-59578.md): In s\_check\_valid\_tile\_param\_custom\_tile of av1\_encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-59575](https://cve.now/CVE-2026-59575.md): In stpropnci\_cb\_observe\_mode\_suspend of stpropnci\_prop\_android.cc, there is a possible way to trigger an out of bounds write into global… (no CVSS)
- [CVE-2026-59574](https://cve.now/CVE-2026-59574.md): In notifyPollingLoopFrames of hal\_fwlog.cc, there is a possible way to trigger an out of bounds read and write when formatting firmware… (no CVSS)
- [CVE-2026-59573](https://cve.now/CVE-2026-59573.md): In max\_num\_ref\_frames of avc\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-58813](https://cve.now/CVE-2026-58813.md): In mmap of mman.c, there is a possible way to trigger an out of bounds read and write via mapping size truncation due to an incorrect… (no CVSS)
- [CVE-2026-58812](https://cve.now/CVE-2026-58812.md): In decode of fw\_vp9\_dec\_pic.c, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-58811](https://cve.now/CVE-2026-58811.md): In smmu\_get\_mair\_idx of smmu.c, there is a possible way to apply incorrect memory attributes to direct memory access mappings due to a… (no CVSS)
- [CVE-2026-58810](https://cve.now/CVE-2026-58810.md): In multiple functions of simd\_ctx.c, there is a possible way to disclose secure vector predicate and fault registers to non-secure callers… (no CVSS)
- [CVE-2026-58809](https://cve.now/CVE-2026-58809.md): In smmu\_domain\_config\_s1 of arm-smmu-v3.c, there is a possible OOB Write due to a missing bounds check. (CVSS 6.7)
- [CVE-2026-58808](https://cve.now/CVE-2026-58808.md): In multiple locations, there is a possible way to dump secure cache lines into non-secure memory on warm reset due to a missing permission… (no CVSS)
- [CVE-2026-58807](https://cve.now/CVE-2026-58807.md): In Retry\_MtsMessageInPending of MtsMessageController.cpp, there is a possible way to trigger memory exhaustion via leaked message objects… (CVSS 7.5)
- [CVE-2026-58806](https://cve.now/CVE-2026-58806.md): In get\_sswrp\_state of cpm\_mbox\_srv/main.c, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-58805](https://cve.now/CVE-2026-58805.md): In multiple locations, there is a possible way to zero arbitrary secure memory via unvalidated image body addresses due to a missing… (no CVSS)
- [CVE-2026-58804](https://cve.now/CVE-2026-58804.md): In ExecuteGraphCommand of multiple files, there is a possible way to trigger an out of bounds write via an oversized scratch memory… (no CVSS)
- [CVE-2026-58803](https://cve.now/CVE-2026-58803.md): In bytes\_are\_equal of lib.rs, there is a possible way to recover authentication keys due to side channel information disclosure. (no CVSS)
- [CVE-2026-58801](https://cve.now/CVE-2026-58801.md): In smmu\_domain\_config\_s1 of arm-smmu-v3.c, there is a possible way to access stale stream table entries across reassigned stream… (no CVSS)
- [CVE-2026-58800](https://cve.now/CVE-2026-58800.md): In IMG\_vkCreateImageView of image\_view.c, there is a possible way to trigger a use after free due to memory corruption. (no CVSS)
- [CVE-2026-58799](https://cve.now/CVE-2026-58799.md): In multiple functions of rmmi\_utility.c, there is a possible way to trigger an out of bounds write due to a missing bounds check. (no CVSS)
- [CVE-2026-58798](https://cve.now/CVE-2026-58798.md): In multiple functions of cn\_Tai.cpp, there is a possible way to trigger an out of bounds write due to memory corruption. (no CVSS)
- [CVE-2026-58797](https://cve.now/CVE-2026-58797.md): In register\_dump\_dpa of sswrp\_pcie.c, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-58796](https://cve.now/CVE-2026-58796.md): In multiple functions of AndroidManifest.xml, there is a possible way to trigger unauthorized firmware updates via exported broadcast… (no CVSS)
- [CVE-2026-58791](https://cve.now/CVE-2026-58791.md): In pic\_timing of hevc\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-58790](https://cve.now/CVE-2026-58790.md): In CMD\_ENC\_SET\_PARAM of encoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-58789](https://cve.now/CVE-2026-58789.md): In s\_gen\_tile\_param of multiple files, there is a possible way to trigger an out of bounds write in tile parameter arrays due to an… (CVSS 7.5)
- [CVE-2026-58788](https://cve.now/CVE-2026-58788.md): In stpropnci\_process\_std of stpropnci\_std.cc, there is a possible way to trigger an out of bounds write into global state due to a missing… (no CVSS)
- [CVE-2026-58787](https://cve.now/CVE-2026-58787.md): In chppWifiRangingEventNotification of clients/wifi.c, there is a possible Heap Buffer Overflow due to a logic error in the code. (no CVSS)
- [CVE-2026-58786](https://cve.now/CVE-2026-58786.md): In cnm\_memset of hevc\_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-58785](https://cve.now/CVE-2026-58785.md): In update\_user\_consent of main.rs, there is a possible elevation of privilege due to uninitialized data. (CVSS 6.7)
- [CVE-2026-58783](https://cve.now/CVE-2026-58783.md): In multiple locations, there is a possible denial of service due to a logic error in the code. (no CVSS)
- [CVE-2026-58782](https://cve.now/CVE-2026-58782.md): In multiple locations, there is a possible denial of service due to a logic error in the code. (no CVSS)
- [CVE-2026-58781](https://cve.now/CVE-2026-58781.md): In HostLinkBase::chreIpiHandler of host\_link.cc, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 6.7)
- [CVE-2026-58780](https://cve.now/CVE-2026-58780.md): In multiple locations, there is a possible out-of-bounds write due to an incorrect bounds check. (no CVSS)
- [CVE-2026-58779](https://cve.now/CVE-2026-58779.md): In multiple locations, there is a possible permission bypass due to a logic error in the code. (no CVSS)
- [CVE-2026-58778](https://cve.now/CVE-2026-58778.md): In multiple locations, there is a possible use-after-free due to a race condition. (CVSS 6.4)
- [CVE-2026-58769](https://cve.now/CVE-2026-58769.md): In multiple locations, there is a possible out-of-bounds read due to a missing bounds check. (no CVSS)
- [CVE-2026-58762](https://cve.now/CVE-2026-58762.md): In ac\_get\_prot\_config of plat\_trusty.c, there is a possible memory corruption due to improper input validation. (no CVSS)
- [CVE-2026-58757](https://cve.now/CVE-2026-58757.md): In mfc\_alloc\_enc\_roi\_buffer of mfc\_buf.c, there is a possible out-of-bounds write due to a heap buffer overflow. (no CVSS)
- [CVE-2026-58752](https://cve.now/CVE-2026-58752.md): In aoc\_unlocked\_ioctl\_handle\_ion\_fd of aoc.c, there is a possible type confusion due to improper input validation. (no CVSS)
- [CVE-2026-58740](https://cve.now/CVE-2026-58740.md): In BitmapImageBuffer of bitmap\_image\_buffer.h, there is a possible out-of-bounds write due to an integer overflow. (no CVSS)
- [CVE-2026-58736](https://cve.now/CVE-2026-58736.md): In NotifySipResponse of SessionEx.cpp, there is a possible way to corrupt memory via a dangling connection pointer in the pending response… (no CVSS)
- [CVE-2026-58729](https://cve.now/CVE-2026-58729.md): In multiple files, there is a possible out-of-bounds write due to a missing bounds check. (CVSS 6.7)
- [CVE-2026-58722](https://cve.now/CVE-2026-58722.md): In chppProcessDiscoverAllResponse of system/chre/chpp/clients/discovery.c, there is a possible Heap Buffer Overflow due to a logic error… (no CVSS)
- [CVE-2026-58705](https://cve.now/CVE-2026-58705.md): In handleEvent of gscan.cpp, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds check. (no CVSS)
- [CVE-2026-58702](https://cve.now/CVE-2026-58702.md): In createIntent of TimerAgent.java, there is a possible permission bypass due to a confused deputy. (no CVSS)
- [CVE-2026-58697](https://cve.now/CVE-2026-58697.md): In codec3p\_secure of codec3p\_secure, there is a possible Heap Buffer Overflow due to a missing bounds check. (no CVSS)
- [CVE-2026-58696](https://cve.now/CVE-2026-58696.md): In multiple locations, there is a possible out-of-bounds write due to a heap buffer overflow. (CVSS 6.7)
- [CVE-2026-58690](https://cve.now/CVE-2026-58690.md): In multiple functions of bitmap\_image\_buffer.h, there is a possible way to trigger an out of bounds write on the trusted execution… (no CVSS)
- [CVE-2026-58684](https://cve.now/CVE-2026-58684.md): In smmu\_config\_l3tt of smmu.c, there is a possible permission bypass due to a logic error in the code. (no CVSS)
- [CVE-2026-58681](https://cve.now/CVE-2026-58681.md): In multiple locations, there is a possible out-of-bounds write due to an integer overflow. (no CVSS)
- [CVE-2026-58680](https://cve.now/CVE-2026-58680.md): In cpm\_mbox\_power\_ctrl\_sswrp of cpm\_mbox.c, there is a possible permission bypass due to a precondition check failure. (no CVSS)
- [CVE-2026-58677](https://cve.now/CVE-2026-58677.md): In get\_secure\_boot\_mode of auth.rs, there is a possible way to bypass root signature verification via fault injection due to a logic error. (no CVSS)
- [CVE-2026-57048](https://cve.now/CVE-2026-57048.md): In authenticate of verify\_image, there is a possible Signature verification logic bypass due to a logic error in the code. (no CVSS)
- [CVE-2026-57047](https://cve.now/CVE-2026-57047.md): In \_\_mfc\_core\_nal\_q\_get\_dec\_metadata\_sei\_nal of mfc\_core\_nal\_q.c, there is a possible out-of-bounds write due to a missing bounds check. (no CVSS)
- [CVE-2026-57043](https://cve.now/CVE-2026-57043.md): In tipc\_dev\_probe of tipc\_virtio\_dev.c, there is a possible way to corrupt memory via an off-by-one cleanup loop on probe failure due to a… (no CVSS)
- [CVE-2026-57037](https://cve.now/CVE-2026-57037.md): In getChppAppState of chpp\_init.cc, there is a possible way to trigger an out of bounds read and corrupt task control structures due to a… (no CVSS)
- [CVE-2026-57036](https://cve.now/CVE-2026-57036.md): In send\_vdu\_directive of gdmc/gsp/dev/bmsm/plat/lga/vdu.c, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-57013](https://cve.now/CVE-2026-57013.md): In access\_control\_enable of multiple files, there is a possible way to release secure coprocessors from reset via unclaimed firewall… (CVSS 6.7)
- [CVE-2026-57010](https://cve.now/CVE-2026-57010.md): In EncodeLastScanBufferElement of data\_manager.cc, there is a possible out-of-bounds write due to a logic error in the code. (no CVSS)
- [CVE-2026-57009](https://cve.now/CVE-2026-57009.md): In GC2AvcDec of GC2AvcDec.cpp, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-57005](https://cve.now/CVE-2026-57005.md): In EuiccPort.buildUiccAccessRule of EuiccPort.java, there is a possible Confused Deputy due to a confused deputy. (no CVSS)
- [CVE-2026-57004](https://cve.now/CVE-2026-57004.md): In PresenceDecoderV1::DecodeDataElements of presence\_decoder\_v1.cc, there is a possible out-of-bounds write due to a missing bounds check. (no CVSS)
- [CVE-2026-56995](https://cve.now/CVE-2026-56995.md): In multiple locations, there is a possible way to corrupt host allocator metadata in shared memory due to memory corruption. (no CVSS)
- [CVE-2026-56980](https://cve.now/CVE-2026-56980.md): In createDataFlowAsync of data\_flow\_manager.cc, there is a possible way to trigger an out of bounds write in shared memory due to an… (no CVSS)
- [CVE-2026-56971](https://cve.now/CVE-2026-56971.md): In AudioSession::SendInternalEvent of AudioSession.cpp, there is a possible Double Free due to a logic error in the code. (no CVSS)
- [CVE-2026-56969](https://cve.now/CVE-2026-56969.md): In edgetpu\_group\_clear\_responses of edgetpu\_group.c, there is a possible Use After Free due to a logic error in the code. (no CVSS)
- [CVE-2026-56966](https://cve.now/CVE-2026-56966.md): In CommitToBuffer of hal\_override\_options.bundle.cc, there is a possible way to retain stale direct memory access mappings to secure… (no CVSS)
- [CVE-2026-56956](https://cve.now/CVE-2026-56956.md): In EncodeT140 of TextRtpPayloadEncoderNode.cpp, there is a possible Heap Buffer Overflow due to a logic error in the code. (no CVSS)
- [CVE-2026-56951](https://cve.now/CVE-2026-56951.md): In on\_vkUpdateDescriptorSetWithTemplateSized2GOOGLE of vk\_decoder\_global\_state.cpp, there is a possible way to leak host code pointers to… (no CVSS)
- [CVE-2026-56949](https://cve.now/CVE-2026-56949.md): In multiple locations, there is a possible way to modify authenticated coprocessor firmware in shared memory before loading due to a race… (CVSS 6.4)
- [CVE-2026-56947](https://cve.now/CVE-2026-56947.md): In getCarrierRestrictionStatus of PhoneInterfaceManager.java, there is a possible permission bypass due to a confused deputy. (no CVSS)
- [CVE-2026-56946](https://cve.now/CVE-2026-56946.md): In smmu\_unmap\_visit\_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping… (no CVSS)
- [CVE-2026-56944](https://cve.now/CVE-2026-56944.md): In smmu\_detach\_dev of private/google-modules/iommu/arm-smmu-v3/drivers/iommu/arm/arm-smmu-v3/pkvm/arm-smmu-v3.c, there is a possible Use… (no CVSS)
- [CVE-2026-56943](https://cve.now/CVE-2026-56943.md): In multiple locations, there is a possible way to trigger an out of bounds read via an attestation comparison oracle due to an incorrect… (no CVSS)
- [CVE-2026-56938](https://cve.now/CVE-2026-56938.md): In port\_shutdown of ipc.c, there is a possible Use After Free due to a race condition. (no CVSS)
- [CVE-2026-56935](https://cve.now/CVE-2026-56935.md): In km\_os\_regen\_salt of storage.c, there is a possible way to recover deleted keys due to a logic error. (no CVSS)
- [CVE-2026-56934](https://cve.now/CVE-2026-56934.md): In arm\_lpae\_split\_blk\_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-56933](https://cve.now/CVE-2026-56933.md): In RecordApTx of efw\_ap\_transport.c, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. (no CVSS)
- [CVE-2026-56930](https://cve.now/CVE-2026-56930.md): In smmu\_find\_ste of smmu.c, there is a possible way to retain stale translation lookaside buffer entries across stream identifiers due to… (no CVSS)
- [CVE-2026-56929](https://cve.now/CVE-2026-56929.md): In TrustyKeyMintManager::VerifyHat of trusty\_keymint\_manager.cc, there is a possible Security check bypass due to a logic error in the code. (no CVSS)
- [CVE-2026-56926](https://cve.now/CVE-2026-56926.md): In multiple functions of PssSubscriptionManager.java, there is a possible way to spoof subscription switch results and trigger a device… (no CVSS)
- [CVE-2026-56919](https://cve.now/CVE-2026-56919.md): In PackageSignatureChecker of SystemUIGoogleModule.java, there is a possible background activity launch due to a confused deputy. (no CVSS)
- [CVE-2026-56916](https://cve.now/CVE-2026-56916.md): In \_vqueue\_get\_avail\_buf\_locked of trusty/kernel/lib/trusty/vqueue.c, there is a possible Double-read / TOCTOU due to a race condition. (no CVSS)
- [CVE-2026-56912](https://cve.now/CVE-2026-56912.md): In ac\_remove\_smmu\_prot\_internal of acfw\_smmu.c, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-56911](https://cve.now/CVE-2026-56911.md): In handle\_fips\_hmac\_req of hwcrypto\_proxy.c, there is a possible heap buffer overflow due to missing bounds check. (CVSS 6.7)
- [CVE-2026-56910](https://cve.now/CVE-2026-56910.md): In multiple locations, there is a possible way to trigger an out of bounds read and write in shared memory due to an incorrect bounds check. (no CVSS)
- [CVE-2026-56909](https://cve.now/CVE-2026-56909.md): In multiple functions of sswrp\_cpm.dtsi, there is a possible way to modify voltage control registers from non-secure software due to a… (no CVSS)
- [CVE-2026-56902](https://cve.now/CVE-2026-56902.md): In multiple locations, there is a possible information disclosure due to a logic error in the code. (no CVSS)
- [CVE-2026-56898](https://cve.now/CVE-2026-56898.md): In aes256\_cmac\_sw of aes.rs, there is a possible way to forge message authentication codes over multi-block messages due to improperly… (no CVSS)
- [CVE-2026-56897](https://cve.now/CVE-2026-56897.md): In multiple functions of attestation\_object.c, there is a possible way to disclose uninitialized secure element stack memory in key… (no CVSS)
- [CVE-2026-56884](https://cve.now/CVE-2026-56884.md): In ac\_set\_ns\_ipa\_tbl of plat\_trusty.c, there is a possible way to corrupt stream table entry configurations via unvalidated parameters due… (CVSS 6.7)
- [CVE-2026-55362](https://cve.now/CVE-2026-55362.md): In multiple files, there is a possible out-of-bounds write due to a missing bounds check. (no CVSS)
- [CVE-2026-55360](https://cve.now/CVE-2026-55360.md): In secure\_transport\_usecase\_handshake of secure\_transport.c, there is a possible way to bypass secure transport channel encryption due to… (no CVSS)
- [CVE-2026-55348](https://cve.now/CVE-2026-55348.md): In GetSharedMemory of trusty\_shared\_memory\_manager.cc, there is a possible way to trigger an out of bounds read via sign extension of a… (no CVSS)
- [CVE-2026-55346](https://cve.now/CVE-2026-55346.md): In km\_read\_data\_response of keymaster.c, there is a possible way to trigger an out of bounds write on the heap due to a missing bounds… (CVSS 6.7)
- [CVE-2026-55344](https://cve.now/CVE-2026-55344.md): In TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic error in the code. (no CVSS)
- [CVE-2026-55335](https://cve.now/CVE-2026-55335.md): In multiple locations, there is a possible use-after-free due to a logic error in the code. (no CVSS)
- [CVE-2026-55321](https://cve.now/CVE-2026-55321.md): In parse\_prime256v1 of keymint\_asn1.c, there is a possible Heap Buffer Overflow due to a logic error in the code. (no CVSS)
- [CVE-2026-55319](https://cve.now/CVE-2026-55319.md): In thread\_free of thread.c, there is a possible way to corrupt kernel heap metadata on thread creation failure due to memory corruption. (no CVSS)
- [CVE-2026-55316](https://cve.now/CVE-2026-55316.md): In handle\_dpm\_image of seclib.rs, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-55312](https://cve.now/CVE-2026-55312.md): In insert\_node of remap.c, there is a possible way to trigger an out of bounds write in the address remapping table due to a non-heap… (no CVSS)
- [CVE-2026-55311](https://cve.now/CVE-2026-55311.md): In N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-55309](https://cve.now/CVE-2026-55309.md): In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault injection due to a… (no CVSS)
- [CVE-2026-55297](https://cve.now/CVE-2026-55297.md): In handle\_chan\_msg of tipc\_virtio\_dev.c, there is a possible way to bypass memory tag access controls via concurrent shared memory… (CVSS 6.4)
- [CVE-2026-14447](https://cve.now/CVE-2026-14447.md): In ext\_mem\_obj\_get\_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an off-by-one check due to… (no CVSS)
- [CVE-2026-0195](https://cve.now/CVE-2026-0195.md): In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due to a logic error. (no CVSS)
- [CVE-2026-0193](https://cve.now/CVE-2026-0193.md): In handle\_rx\_msg of tipc\_virtio\_dev, there is a possible Double Fetch TOCTOU due to Double Fetch. (no CVSS)
- [CVE-2026-0191](https://cve.now/CVE-2026-0191.md): In event\_set\_sub of acropora\_event.c, there is a possible Logic error due to a logic error in the code. (no CVSS)
- [CVE-2026-0178](https://cve.now/CVE-2026-0178.md): In multiple functions of arm-smmu-v3.c, there is a possible way to bypass direct memory access isolation via stale stream table entries… (no CVSS)
- [CVE-2026-0175](https://cve.now/CVE-2026-0175.md): In multiple locations, there is a possible way to bypass key authorization policies during wrapped key import due to a logic error. (no CVSS)
- [CVE-2026-0169](https://cve.now/CVE-2026-0169.md): In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test or debugging code. (no CVSS)
- [CVE-2026-125342](https://cve.now/CVE-2026-125342.md): Uninitialized resource in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a… (CVSS 4.7)
- [CVE-2026-125349](https://cve.now/CVE-2026-125349.md): Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.50 allowed a remote attacker who had compromised the… (CVSS 3.4)
- [CVE-2026-125350](https://cve.now/CVE-2026-125350.md): Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a… (CVSS 8.8, KEV)
- [CVE-2026-125346](https://cve.now/CVE-2026-125346.md): Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a… (CVSS 8.8)
- [CVE-2026-125344](https://cve.now/CVE-2026-125344.md): Type confusion in V8 in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a… (CVSS 8.8)
- [CVE-2026-125348](https://cve.now/CVE-2026-125348.md): Out of bounds write in GPU in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to potentially execute arbitrary code outside… (CVSS 8.8)
- [CVE-2026-125343](https://cve.now/CVE-2026-125343.md): Buffer overflow in Compositing in Google Chrome prior to 157.0.8103.50 allowed a remote attacker who had compromised the renderer process… (CVSS 8.3)
- [CVE-2026-125347](https://cve.now/CVE-2026-125347.md): Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.50 allowed a remote attacker leveraging social engineering to… (CVSS 9.6)
- [CVE-2026-125345](https://cve.now/CVE-2026-125345.md): Uninitialized resource in WebGL in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to read memory outside the sandbox via a… (CVSS 4.7)
- [CVE-2026-120930](https://cve.now/CVE-2026-120930.md): Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a… (CVSS 5.4)
- [CVE-2026-120931](https://cve.now/CVE-2026-120931.md): Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code… (CVSS 9.6)
- [CVE-2026-121141](https://cve.now/CVE-2026-121141.md): Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to… (CVSS 5.4)
- [CVE-2026-121195](https://cve.now/CVE-2026-121195.md): Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via… (CVSS 8.8)
- [CVE-2026-121064](https://cve.now/CVE-2026-121064.md): Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary… (CVSS 7.8)
- [CVE-2026-121169](https://cve.now/CVE-2026-121169.md): Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to… (CVSS 6.5)
- [CVE-2026-121069](https://cve.now/CVE-2026-121069.md): Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via… (CVSS 8.8)
- [CVE-2026-121142](https://cve.now/CVE-2026-121142.md): Incorrect authorization in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to… (CVSS 6.5)
- [CVE-2026-121232](https://cve.now/CVE-2026-121232.md): Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a local attacker leveraging social engineering to obtain… (CVSS 5.1)
- [CVE-2026-121041](https://cve.now/CVE-2026-121041.md): Missing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a… (CVSS 6.5)
- [CVE-2026-121093](https://cve.now/CVE-2026-121093.md): Out of bounds read in Animation in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially read memory inside the… (CVSS 5.7)
- [CVE-2026-121230](https://cve.now/CVE-2026-121230.md): Race condition in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside… (CVSS 8.3)
- [CVE-2026-121073](https://cve.now/CVE-2026-121073.md): Use after free in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside… (CVSS 9.6)
- [CVE-2026-121092](https://cve.now/CVE-2026-121092.md): Uncontrolled recursion in SVG in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code… (CVSS 8.8)
- [CVE-2026-121175](https://cve.now/CVE-2026-121175.md): Improper resource exposure in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted… (CVSS 4.3)
- [CVE-2026-121054](https://cve.now/CVE-2026-121054.md): Improper state validation in XML in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a… (CVSS 8.8)
- [CVE-2026-121029](https://cve.now/CVE-2026-121029.md): Incorrect authorization in ORB in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass site isolation via a crafted… (CVSS 4.3)
- [CVE-2026-121045](https://cve.now/CVE-2026-121045.md): UI misrepresentation in Browser in Google Chrome on on Mac prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering… (CVSS 5.4)
- [CVE-2026-121162](https://cve.now/CVE-2026-121162.md): UI misrepresentation in Notifications in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social… (CVSS 5.4)
- [CVE-2026-121225](https://cve.now/CVE-2026-121225.md): Incorrect authorization in Permissions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to… (CVSS 6.5)
- [CVE-2026-121198](https://cve.now/CVE-2026-121198.md): Confused deputy in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web… (CVSS 8.8)
- [CVE-2026-121240](https://cve.now/CVE-2026-121240.md): Improper input validation in Variations in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access… (CVSS 4.3)
- [CVE-2026-121081](https://cve.now/CVE-2026-121081.md): UI misrepresentation in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to… (CVSS 5.9)
- [CVE-2026-121050](https://cve.now/CVE-2026-121050.md): Race condition in Mobile in Google Chrome on on iOS prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a… (CVSS 8.8)
- [CVE-2026-121205](https://cve.now/CVE-2026-121205.md): Incorrect authorization in CORS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass… (CVSS 8.8)
- [CVE-2026-121204](https://cve.now/CVE-2026-121204.md): Incomplete cleanup in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted… (CVSS 8.8)
- [CVE-2026-121159](https://cve.now/CVE-2026-121159.md): Incorrect authorization in History in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to… (CVSS 4.3)
- [CVE-2026-121085](https://cve.now/CVE-2026-121085.md): Incorrect authorization in WebUI in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass system access restrictions… (CVSS 4.3)
- [CVE-2026-121251](https://cve.now/CVE-2026-121251.md): Missing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted… (CVSS 8.8)
- [CVE-2026-121130](https://cve.now/CVE-2026-121130.md): Observable discrepancy in Forms in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain sensitive information via a… (CVSS 5.3)
- [CVE-2026-121121](https://cve.now/CVE-2026-121121.md): UI misrepresentation in PageInfo in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML… (CVSS 5.4)
- [CVE-2026-121189](https://cve.now/CVE-2026-121189.md): Use after free in Browser in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox… (CVSS 9.6)
- [CVE-2026-121206](https://cve.now/CVE-2026-121206.md): UI misrepresentation in Isolated in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof… (CVSS 5.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/google
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.