Google CVEs
9,110 CVEs and advisories name Google as an affected vendor, 82 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-22421In contentDescForNotification of NotificationContentDescription.kt, there is a possible notification content leak through the lockscreen due
- CVE-2025-22419In multiple locations, there is a possible way to mislead the user into enabling malicious phone calls forwarding due to a tapjacking/overla
- CVE-2025-22418In multiple locations, there is a possible confused deputy due to Intent Redirect.
- CVE-2025-22417In finishTransition of Transition.java, there is a possible way to bypass touch filtering restrictions due to a tapjacking/overlay attack.
- CVE-2025-22416In onCreate of ChooserActivity.java , there is a possible way to view other users' images due to a confused deputy.
- CVE-2024-49730In FuseDaemon.cpp, there is a possible out of bounds write due to memory corruption.
- CVE-2024-49728In generateFileInfo of BluetoothOppSendFileInfo.java, there is a possible cross user media disclosure due to a confused deputy.
- CVE-2024-49722In showAvatarPicker of EditUserPhotoController.java, there is a possible cross user image leak due to a confused deputy.
- CVE-2024-49720In multiple functions of Permissions.java, there is a possible way to override the state of the user's location permissions due to a logic e
- CVE-2024-40653In multiple functions of ConnectionServiceWrapper.java, there is a possible way to retain a permission forever in the background due to a lo
- CVE-2025-26417In checkWhetherCallingAppHasAccess of DownloadProvider.java, there is a possible bypass of user consent when opening files in shared storage
- CVE-2025-22413In multiple functions of hyp-main.c, there is a possible privilege escalation due to a logic error in the code.
- CVE-2025-22412In multiple functions of sdp_server.cc, there is a possible use after free due to a logic error in the code.
- CVE-2025-22411In process_service_attr_rsp of sdp_discovery.cc, there is a possible use after free due to a logic error in the code.
- CVE-2025-22410In multiple locations, there is a possible way to execute arbitrary code due to a use after free.
- CVE-2025-22409In rfc_send_buf_uih of rfc_ts_frames.cc, there is a possible way to execute arbitrary code due to a use after free.
- CVE-2025-22408In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free.
- CVE-2025-22407In hidd_check_config_done of hidd_conn.cc, there is a possible way to execute arbitrary code due to a use after free.
- CVE-2025-22406In bnepu_check_send_packet of bnep_utils.cc, there is a possible way to achieve code execution due to a use after free.
- CVE-2025-22405In multiple locations, there is a possible way to execute arbitrary code due to a use after free.
- CVE-2025-22404In avct_lcb_msg_ind of avct_lcb_act.cc, there is a possible way to execute arbitrary code due to a use after free.
- CVE-2025-22403In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free.
- CVE-2025-0093In handleBondStateChanged of AdapterService.java, there is a possible unapproved data access due to a missing permission check.
- CVE-2025-0092In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficient UI.
- CVE-2025-0086In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check.
- CVE-2025-0084In multiple locations, there is a possible out of bounds write due to a use after free.
- CVE-2025-0083In multiple locations, there is a possible way to access content across user profiles due to URI double encoding.
- CVE-2025-0082In multiple functions of StatusHint.java and TelecomServiceImpl.java, there is a possible way to reveal images across users due to a confuse
- CVE-2025-0081In dng_lossless_decoder::HuffDecode of dng_lossless_jpeg.cpp, there is a possible way to cause a crash due to uninitialized data.
- CVE-2025-0080In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack.