CVE-20XX-?
agent?

Google Android CVEs.

Published CVEs affecting Google Android, ranked by exploit odds.

83 CVEs · updated 2026-11-10 13:00 UTC

Reset all
  1. CVE-2015-1538

    Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code via crafted atoms in MP4 data that trigger an unchecked multiplication, aka internal bug 20139950, a related issue to CVE-2015-4496.

    Drop everything Code execution OS & kernel Google Android

    10.0 HIGH 99% exploit odds Fix listed
  2. CVE-2015-3829

    Off-by-one error in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted MPEG-4 covr atoms with a size equal to SIZE_MAX, aka internal bug 20923261.

    Drop everything Code execution OS & kernel Google Android

    10.0 HIGH 90% exploit odds Fix listed
  3. CVE-2015-3864

    Integer underflow in the MPEG4Extractor::parseChunk function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android before 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted MPEG-4 data, aka internal bug 23034759. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-3824.

    Drop everything Code execution OS & kernel Google Android

    10.0 HIGH 87% exploit odds Fix listed
  4. CVE-2015-1539

    Multiple integer underflows in the ESDS::parseESDescriptor function in ESDS.cpp in libstagefright in Android before 5.1.1 LMY48I allow remote attackers to execute arbitrary code via crafted ESDS atoms, aka internal bug 20139950, a related issue to CVE-2015-4493.

    Drop everything Code execution OS & kernel Google Android

    10.0 HIGH 86% exploit odds Fix listed
  5. CVE-2013-4710

    Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.

    Drop everything Code execution Device Google Android

    9.3 HIGH 43% exploit odds No fix listed
  6. CVE-2014-7911

    luni/src/main/java/java/io/ObjectInputStream.java in the java.io.ObjectInputStream implementation in Android before 5.0.0 does not verify that deserialization will result in an object that met the requirements for serialization, which allows attackers to execute arbitrary code via a crafted finalize method for a serialized object in an ArrayMap Parcel within an intent sent to system_service, as demonstrated by the finalize method of android.os.BinderProxy, aka Bug 15874291.

    Code execution Device Google Android

    7.2 HIGH 23% exploit odds No fix listed
  7. CVE-2017-13156

    An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-64211847.

    Code execution Device Google Android

    7.8 HIGH 20% exploit odds Fix listed
  8. CVE-2021-0870

    In RW_SetActivatedTagType of rw_main.cc, there is possible memory corruption due to a race condition. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10 Android-11 Android-8.1Android ID: A-192472262

    Code execution Device Google Android

    8.1 HIGH 7% exploit odds Fix listed
  9. CVE-2015-6602

    libutils in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file, as demonstrated by an attack against use of libutils by libstagefright in Android 5.x.

    Code execution Device Google Android

    9.3 HIGH 3% exploit odds No fix listed
  10. CVE-2015-3876

    libstagefright in Android through 5.1.1 LMY48M allows remote attackers to execute arbitrary code via crafted metadata in a (1) MP3 or (2) MP4 file.

    Code execution Device Google Android

    9.3 HIGH 3% exploit odds Fix listed
  11. CVE-2016-10230

    A remote code execution vulnerability in the Qualcomm crypto driver. Product: Android. Versions: Android kernel. Android ID: A-34389927. References: QC-CR#1091408.

    Code execution OS & kernel Google Android

    9.8 CRITICAL 3% exploit odds Fix listed
  12. CVE-2016-0815

    The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H, and 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 26365349.

    Code execution Device Google Android

    9.8 CRITICAL 3% exploit odds Fix listed
  13. CVE-2015-6575

    SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I does not properly consider integer promotion, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow and memory corruption) via crafted atoms in MP4 data, aka internal bug 20139950, a different vulnerability than CVE-2015-1538. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-7915, CVE-2014-7916, and/or CVE-2014-7917.

    Code execution OS & kernel Google Android

    10.0 HIGH 3% exploit odds Fix listed
  14. CVE-2016-6727

    The Qualcomm GPS subsystem in Android on Android One devices allows remote attackers to execute arbitrary code.

    Code execution Device Google Android

    9.8 CRITICAL 3% exploit odds Fix listed
  15. CVE-2016-3840

    Conscrypt in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session reuse, which allows remote attackers to execute arbitrary code via unspecified vectors, aka internal bug 28751153.

    Code execution Device Google Android

    9.8 CRITICAL 2% exploit odds Fix listed
  16. CVE-2015-6598

    libstagefright in Android before 5.1.1 LMY48T allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 23306638.

    Code execution Device Google Android

    10.0 HIGH 2% exploit odds Fix listed
  17. CVE-2016-1155

    HTTP header injection vulnerability in the URLConnection class in Android OS 2.2 through 6.0 allows remote attackers to execute arbitrary scripts or set arbitrary values in cookies.

    Code execution Device Google Android

    9.8 CRITICAL 2% exploit odds Fix listed
  18. CVE-2017-13229

    A remote code execution vulnerability in the Android media framework (n/a). Product: Android. Versions: 7.0, 7.1.1, 7.1.2, 8.0, 8.1. ID: A-68160703.

    Code execution Device Google Android

    9.8 CRITICAL 2% exploit odds Fix listed
  19. CVE-2021-0889

    In Android TV , there is a possible silent pairing due to lack of rate limiting in the pairing flow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-8.1 Android-9Android ID: A-180745296

    Code execution Device Google Android

    9.8 CRITICAL 2% exploit odds Fix listed
  20. CVE-2019-2130

    In CompilationJob::FinalizeJob of compiler.cc, there is a possible remote code execution due to type confusion. This could lead to escalation of privilege from a malicious proxy configuration with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-132073833.

    Code execution Device Google Android

    9.8 CRITICAL 2% exploit odds Fix listed
  21. CVE-2015-3837

    The OpenSSLX509Certificate class in org/conscrypt/OpenSSLX509Certificate.java in Android before 5.1.1 LMY48I improperly includes certain context data during serialization and deserialization, which allows attackers to execute arbitrary code via an application that sends a crafted Intent, aka internal bug 21437603.

    Code execution Device Google Android

    9.3 HIGH 2% exploit odds Fix listed
  22. CVE-2015-3849

    The Region_createFromParcel function in core/jni/android/graphics/Region.cpp in Region in Android before 5.1.1 LMY48M does not check the return values of certain read operations, which allows attackers to execute arbitrary code via an application that sends a crafted message to a service, aka internal bug 21585255.

    Code execution Device Google Android

    9.3 HIGH 1% exploit odds Fix listed
  23. CVE-2016-3741

    The H.264 decoder in mediaserver in Android 6.x before 2016-07-01 does not initialize certain slice data, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28165661.

    Code execution Device Google Android

    9.8 CRITICAL 1% exploit odds Fix listed
  24. CVE-2019-2097

    In HAliasAnalyzer.Query of hydrogen-alias-analysis.h, there is possible memory corruption due to type confusion. This could lead to remote code execution from a malicious proxy configuration, with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-117606285.

    Code execution Device Google Android

    9.8 CRITICAL 1% exploit odds Fix listed
  25. CVE-2015-3863

    Multiple integer overflows in the Blob class in keystore/keystore.cpp in Keystore in Android before 5.1.1 LMY48M allow attackers to execute arbitrary code and read arbitrary Keystore keys via an application that uses a crafted blob in an insert operation, aka internal bug 22802399.

    Code execution Device Google Android

    9.3 HIGH 1% exploit odds Fix listed
  26. CVE-2016-3742

    decoder/ih264d_process_intra_mb.c in mediaserver in Android 6.x before 2016-07-01 mishandles intra mode, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 28165659.

    Code execution Device Google Android

    9.8 CRITICAL 1% exploit odds Fix listed
  27. CVE-2016-3743

    decoder/ih264d_api.c in mediaserver in Android 6.x before 2016-07-01 does not initialize certain data structures, which allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted media file, aka internal bug 27907656.

    Code execution Device Google Android

    9.8 CRITICAL 1% exploit odds Fix listed
  28. CVE-2019-9365

    In Bluetooth, there is a possible deserialization error due to missing string validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. Product: AndroidVersions: Android-10Android ID: A-109838537

    Code execution Device Google Android

    9.8 CRITICAL 1.0% exploit odds Fix listed
  29. CVE-2020-10837

    An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (with TEEGRIS) software. The Esecomm Trustlet allows a stack overflow and arbitrary code execution. The Samsung ID is SVE-2019-15984 (February 2020).

    Code execution Device Google Android

    9.8 CRITICAL 0.9% exploit odds Fix listed
  30. CVE-2019-20583

    An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the EXT_FR Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14847 (August 2019).

    Code execution Device Google Android

    9.8 CRITICAL 0.9% exploit odds Fix listed
  31. CVE-2019-20584

    An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the HDCP Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14850 (August 2019).

    Code execution Device Google Android

    9.8 CRITICAL 0.9% exploit odds Fix listed
  32. CVE-2019-20585

    An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SEC_FR Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14851 (August 2019).

    Code execution Device Google Android

    9.8 CRITICAL 0.9% exploit odds Fix listed
  33. CVE-2019-20586

    An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (with TEEGRIS) software. There is type confusion in the FINGERPRINT Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14864 (August 2019).

    Code execution Device Google Android

    9.8 CRITICAL 0.9% exploit odds Fix listed
  34. CVE-2019-20587

    An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (with TEEGRIS) software. There is type confusion in the MLDAP Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14867 (August 2019).

    Code execution Device Google Android

    9.8 CRITICAL 0.9% exploit odds Fix listed
  35. CVE-2019-20588

    An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SEM Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14891 (August 2019).

    Code execution Device Google Android

    9.8 CRITICAL 0.9% exploit odds Fix listed
  36. CVE-2019-20589

    An issue was discovered on Samsung mobile devices with O(8.x) and P(9.0) (with TEEGRIS) software. There is type confusion in the SKPM Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14892 (August 2019).

    Code execution Device Google Android

    9.8 CRITICAL 0.9% exploit odds Fix listed
  37. CVE-2018-21051

    An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) (Exynos chipsets) software. There is an invalid free in the fingerprint Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2018-12853 (October 2018).

    Code execution Device Google Android

    9.8 CRITICAL 0.9% exploit odds Fix listed
  38. CVE-2020-0333

    In UrlQuerySanitizer, there is a possible improper input validation. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-73822755

    Code execution Device Google Android

    9.8 CRITICAL 0.8% exploit odds Fix listed
  39. CVE-2018-21055

    An issue was discovered on Samsung mobile devices with N(7.0) (Qualcomm models using MSM8996 chipsets) software. A device can be rooted with a custom image to execute arbitrary scripts in the INIT context. The Samsung ID is SVE-2018-11940 (September 2018).

    Code execution Device Google Android

    9.8 CRITICAL 0.8% exploit odds Fix listed
  40. CVE-2024-31317

    In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to unsafe deserialization. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.

    Code execution Device Google Android

    7.8 HIGH 0.8% exploit odds Fix listed
  41. CVE-2020-11603

    An issue was discovered on Samsung mobile devices with P(9.0) and Q(10.0) (incorporating TEEGRIS) software. Type confusion in the MLDAP Trustlet allows arbitrary code execution. The Samsung ID is SVE-2020-16599 (April 2020).

    Code execution Device Google Android

    9.8 CRITICAL 0.8% exploit odds Fix listed
  42. CVE-2020-25053

    An issue was discovered on Samsung mobile devices with Q(10.0) (exynos9830 chipsets) software. RKP allows arbitrary code execution. The Samsung ID is SVE-2020-17435 (August 2020).

    Code execution Device Google Android

    9.8 CRITICAL 0.7% exploit odds Fix listed
  43. CVE-2020-13832

    An issue was discovered on Samsung mobile devices with Q(10.0) (with TEEGRIS on Exynos chipsets) software. The Widevine Trustlet allows arbitrary code execution because of memory disclosure, The Samsung IDs are SVE-2020-17117, SVE-2020-17118, SVE-2020-17119, and SVE-2020-17161 (June 2020).

    Code execution Device Google Android

    9.8 CRITICAL 0.7% exploit odds Fix listed
  44. CVE-2017-18652

    An issue was discovered on Samsung mobile devices with M(6.0) and N(7.x) software. SVoice allows arbitrary code execution by changing dynamic libraries. The Samsung ID is SVE-2017-9299 (September 2017).

    Code execution Device Google Android

    9.8 CRITICAL 0.7% exploit odds Fix listed
  45. CVE-2019-20571

    An issue was discovered on Samsung mobile devices with O(8.x) (with TEEGRIS) software. There is type confusion in the WVDRM Trustlet, leading to arbitrary code execution. The Samsung ID is SVE-2019-14885 (September 2019).

    Code execution Device Google Android

    9.8 CRITICAL 0.7% exploit odds Fix listed
  46. CVE-2018-21075

    An issue was discovered on Samsung mobile devices with N(7.x) and O(8.x) software. The Call+ application can load classes from an unintended path, leading to Code Execution. The Samsung ID is SVE-2017-10886 (April 2018).

    Code execution Device Google Android

    9.8 CRITICAL 0.7% exploit odds Fix listed
  47. CVE-2022-42536

    Remote code execution

    Code execution Device Google Android

    9.8 CRITICAL 0.6% exploit odds Fix listed
  48. CVE-2022-42537

    Remote code execution

    Code execution Device Google Android

    9.8 CRITICAL 0.6% exploit odds Fix listed
  49. CVE-2023-21287

    In multiple locations, there is a possible code execution due to type confusion. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.

    Code execution Device Google Android

    9.8 CRITICAL 0.5% exploit odds Fix listed
  50. CVE-2022-22265

    An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution.

    exploited Code execution Device Google Android

    5.0 MEDIUM 0.4% exploit odds Fix listed

All CVEs affecting Google Android that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.