Google Chrome for Android UI Heap Buffer Overflow Vulnerability

In Package Manager, there is a possible device lock controller bypass due to a missing permission check

An improper input validation vulnerability in sflacfd_get_frm() in libsflacextractor library prior to SMR MAY-2021 Release 1 allows attackers to execute arbitrary code on…

In BluetoothCccHandlerCallbackImpl of bluetooth_ccc.cc, there is a possible use-after-free due to a logic error in the code

In multiple locations, there is a possible use-after-free due to a logic error in the code

In IP Multimedia Subsystem, there is a possible authentication bypass due to a logic error in the code

In multiple functions of ftsmooth.c, there is a possible memory safety issue due to improper casting

In multiple locations, there is a possible memory safety issue due to a heap buffer overflow

In handleBondStateChanged of AdapterService.java, there is a possible way to skip pairing due to a logic error in the code

In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free

In WC-Radio, there is a possible out of bounds write due to a missing bounds check

In modem, there is a possible out of bounds write due to an incorrect bounds check

In __mfc_handle_released_buf of mfc_core_isr.c, there is a possible out of bounds write due to a missing bounds check

In Modem, there is a possible out of bounds write due to an incorrect bounds check

In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check

In ns_GetUserData of ns_SmscbUtilities.c, there is a possible out of bounds write due to an incorrect bounds check

In MM_DATA_IND of cn_NrSmMsgHdlrFromMM.cpp, there is a possible EoP due to memory corruption

In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow

In AudioDecoder::HandleProduceRequest of audio_decoder.cc, there is a possible out of bounds write due to an incorrect bounds check

In multiple locations, there is a possible way to launch an application from the background due to a precondition check failure

WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396458384

In unknown of cd_CnMsgCodecUserApi.cpp, there is a possible out of bounds write due to a missing bounds check

WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106

Elevation of Privilege

In initializeSwizzler of SkBmpStandardCodec.cpp, there is a possible out of bounds write due to a heap buffer overflow

In avdt_msg_ind of avdt_msg.cc, there is a possible memory corruption due to type confusion

In multiple locations, there is a possible way to execute arbitrary code due to a logic error in the code

In rfc_check_send_cmd of rfc_utils.cc, there is a possible way to execute arbitrary code due to a use after free

In sdp_snd_service_search_req of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free

In process_service_search_attr_req of sdp_server.cc, there is a possible way to execute arbitrary code due to a use after free

In process_service_attr_rsp of sdp_discovery.cc, there is a possible way to execute arbitrary code due to a use after free

In gatts_process_primary_service_req of gatt_sr.cc, there is a possible out of bounds write due to a heap buffer overflow

In gatts_process_read_by_type_req of gatt_sr.cc, there is a possible out of bounds write due to a logic error in the code

In wlan STA FW, there is a possible out of bounds write due to improper input validation

In cc_SendCcImsInfoIndMsg of cc_MmConManagement.c, there is a possible out of bounds write due to a missing bounds check

In store_upgrade and store_cmd of drivers/input/touchscreen/stm/ftm4_pdc.c, there are out of bound writes due to missing bounds checks or integer underflows

In prop2cfg of btif_storage.cc, there is a possible out of bounds write due to an incorrect bounds check

In handle_app_cur_val_response of dtif_rc.cc, there is a possible stack buffer overflow due to a missing bounds check

In process_service_attr_req and process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds check

In process_service_attr_req and process_service_search_attr_req of sdp_server.cc, there is an out of bounds write due to a missing bounds check

In the getHost() function of UriTest.java, there is the possibility of incorrect web origin determination

In filterMask of SkEmbossMaskFilter.cpp, there is a possible out of bounds write due to an integer overflow

In wlan firmware, there is a possible out of bounds write due to improper input validation

In wlan driver, there is a possible out of bounds write due to improper input validation

In wlan driver, there is a possible out of bounds write due to improper input validation

In venc, there is a possible out of bounds write due to a missing bounds check

In gnss service, there is a possible escalation of privilege due to improper certificate validation

In venc, there is a possible out of bounds write due to type confusion

In wl_notify_rx_mgmt_frame of wl_cfg80211.c, there is a possible out of bounds write due to an integer overflow

There is a possible escalation of privilege due to improperly used crypto