Google CVEs
9,110 CVEs and advisories name Google as an affected vendor, 82 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-26461In Permission Manager, there is a possible way for the microphone privacy indicator to remain activated even after the user attempts to clos
- CVE-2025-26434In libxml2, there is a possible out of bounds read due to a buffer overflow.
- CVE-2024-0028In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check.
- CVE-2025-32322In onCreate of MediaProjectionPermissionActivity.java , there is a possible way to grant a malicious app a token enabling unauthorized scree
- CVE-2025-26439In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to be enabled instead of
- CVE-2025-26431In setupAccessibilityServices of AccessibilityFragment.java, there is a possible way to hide an enabled accessibility service due to a logic
- CVE-2025-26419In initPhoneSwitch of SystemSettingsFragment.java, there is a possible FRP bypass due to a logic error in the code.
- CVE-2024-40664In setupAccessibilityServices of AccessibilityFragment.java , there is a possible way to hide an enabled accessibility service due to a logi
- CVE-2025-22415In android_app of Android.bp, there is a possible way to launch any activity as a system user.
- CVE-2025-22414In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check.
- CVE-2024-49731In apk-versions.txt, there is a possible corruption of telemetry opt-in settings on other watches when setting up a new Pixel Watch due to…
- CVE-2025-48581In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates due to a logic error in the code.
- CVE-2025-48563In onNullBinding of RemoteFillService.java, there is a possible background activity launch due to an insecure default value.
- CVE-2025-48562In writeContent of RemotePrintDocument.java, there is a possible information disclosure due to a logic error.
- CVE-2025-48561In multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure.
- CVE-2025-48560In AndroidManifest.xml, there is a possible way for an app to monitor motion events due to a confused deputy.
- CVE-2025-48559In multiple functions of AppOpsService.java, there is a possible add a large amount of app ops due to improper input validation.
- CVE-2025-48558In multiple functions of BatteryService.java, there is a possible way to hijack implicit intent intended for system app due to Implicit inte
- CVE-2025-48556In multiple methods of NotificationChannel.java, there is a possible desynchronization from persistence due to improper input validation.
- CVE-2025-48554In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible persistent denial of service due to a logic error in the co
- CVE-2025-48553In handlePackagesChanged of DevicePolicyManagerService.java, there is a possible DoS of a device admin due to a logic error in the code.
- CVE-2025-48552In saveGlobalProxyLocked of DevicePolicyManagerService.java, there is a possible way to desync from persistence due to a logic error in the
- CVE-2025-48551In multiple locations, there is a possible leak of an image across the Android User isolation boundary due to a confused deputy.
- CVE-2025-48550In testGrantSlicePermission of SliceManagerTest.java, there is a possible permanent denial of service due to a path traversal error.
- CVE-2025-48549In multiple locations, there is a possible way to record audio via a background app due to a missing permission check.
- CVE-2025-48548In multiple functions of AppOpsControllerImpl.java, there is a possible way to record audio without displaying the privacy indicator due to
- CVE-2025-48547In multiple locations, there is a possible one-time permission bypass due to a logic error in the code.
- CVE-2025-48546In checkPermissions of SafeActivityOptions.java, there is a possible background activity launch due to a logic error in the code.
- CVE-2025-48545In isSystemUid of AccountManagerService.java, there is a possible way for an app to access privileged APIs due to a confused deputy.
- CVE-2025-48544In multiple locations, there is a possible way to read files belonging to other apps due to SQL injection.