Refine your search
206 vulnerabilities found for Android by Google
CVE-2025-20749 (GCVE-0-2025-20749)
Vulnerability from nvd
Published
2025-11-04 06:20
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-121 - Stack Overflow
Summary
In charger, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915493; Issue ID: MSV-3800.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT6789, MT6835, MT6855, MT6878, MT6879, MT6886, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT8169, MT8188, MT8195, MT8196, MT8781, MT8796 |
Version: Android 14.0, 15.0, 16.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20749",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:28.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT6789, MT6835, MT6855, MT6878, MT6879, MT6886, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT8169, MT8188, MT8195, MT8196, MT8781, MT8796",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 14.0, 15.0, 16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In charger, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915493; Issue ID: MSV-3800."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:20:51.979Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20749",
"datePublished": "2025-11-04T06:20:51.979Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:28.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20747 (GCVE-0-2025-20747)
Vulnerability from nvd
Published
2025-11-04 06:20
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-121 - Stack Overflow
Summary
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT2718, MT2737, MT6835, MT6878, MT6886, MT6897, MT6899, MT6982, MT6985, MT6986, MT6986D, MT6989, MT6990, MT6991, MT8676, MT8678, MT8755, MT8893 |
Version: Android 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 / Zephyr 3.7.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20747",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:31.133Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT2737, MT6835, MT6878, MT6886, MT6897, MT6899, MT6982, MT6985, MT6986, MT6986D, MT6989, MT6990, MT6991, MT8676, MT8678, MT8755, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 / Zephyr 3.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:20:19.607Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20747",
"datePublished": "2025-11-04T06:20:19.607Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:31.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20746 (GCVE-0-2025-20746)
Vulnerability from nvd
Published
2025-11-04 06:20
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-121 - Stack Overflow
Summary
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT2718, MT2737, MT6835, MT6878, MT6886, MT6897, MT6899, MT6982, MT6985, MT6986, MT6986D, MT6989, MT6990, MT6991, MT8676, MT8678, MT8755, MT8893 |
Version: Android 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 / Zephyr 3.7.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:32.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT2737, MT6835, MT6878, MT6886, MT6897, MT6899, MT6982, MT6985, MT6986, MT6986D, MT6989, MT6990, MT6991, MT8676, MT8678, MT8755, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 / Zephyr 3.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:20:17.860Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20746",
"datePublished": "2025-11-04T06:20:17.860Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:32.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20745 (GCVE-0-2025-20745)
Vulnerability from nvd
Published
2025-11-04 06:20
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-416 - Use After Free
Summary
In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10095441; Issue ID: MSV-4294.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT2718, MT6989, MT6991, MT8370, MT8390, MT8395, MT8676, MT8678, MT87920 |
Version: Android 13.0, 14.0, 15.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20745",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:47.647Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT6989, MT6991, MT8370, MT8390, MT8395, MT8676, MT8678, MT87920",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 13.0, 14.0, 15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10095441; Issue ID: MSV-4294."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:20:03.095Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20745",
"datePublished": "2025-11-04T06:20:03.095Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:47.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20744 (GCVE-0-2025-20744)
Vulnerability from nvd
Published
2025-11-04 06:19
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-416 - Use After Free
Summary
In pda, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10127160; Issue ID: MSV-4542.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT6899, MT6991, MT8793 |
Version: Android 13.0, 14.0, 15.0, 16.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20744",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:45.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT6899, MT6991, MT8793",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 13.0, 14.0, 15.0, 16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In pda, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10127160; Issue ID: MSV-4542."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:19:59.710Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20744",
"datePublished": "2025-11-04T06:19:59.710Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:45.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20743 (GCVE-0-2025-20743)
Vulnerability from nvd
Published
2025-11-04 06:19
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-416 - Use After Free
Summary
In clkdbg, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10136671; Issue ID: MSV-4651.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20743",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:44.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT6761, MT6765, MT6768, MT6781, MT6853, MT6877, MT6886, MT6893, MT6897, MT6899, MT6983, MT6989, MT6991, MT8113, MT8163, MT8168, MT8169, MT8183, MT8186, MT8188, MT8195, MT8196, MT8321, MT8365, MT8385, MT8390, MT8391, MT8512, MT8516, MT8519, MT8676, MT8678, MT8695, MT8696, MT8698, MT8755, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8873, MT8883, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 14.0, 15.0, 16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In clkdbg, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10136671; Issue ID: MSV-4651."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:19:57.990Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20743",
"datePublished": "2025-11-04T06:19:57.990Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:44.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20730 (GCVE-0-2025-20730)
Vulnerability from nvd
Published
2025-11-04 06:19
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication - Generic
Summary
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10068463; Issue ID: MSV-4141.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT2737, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6990, MT6991, MT8188, MT8195, MT8676, MT8678, MT8696 |
Version: Android 13.0, 14.0, 15.0, 16.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20730",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:40.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2737, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6990, MT6991, MT8188, MT8195, MT8676, MT8678, MT8696",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 13.0, 14.0, 15.0, 16.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10068463; Issue ID: MSV-4141."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:19:47.152Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20730",
"datePublished": "2025-11-04T06:19:47.152Z",
"dateReserved": "2024-11-01T01:21:50.393Z",
"dateUpdated": "2025-11-05T04:55:40.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48581 (GCVE-0-2025-48581)
Vulnerability from nvd
Published
2025-09-04 18:34
Modified
2025-11-04 14:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Elevation of privilege
Summary
In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates through mainline installations due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-48581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-05T03:55:51.910844Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T14:20:25.197Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "16"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates through mainline installations due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-04T18:34:41.808Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/security/bulletin/2025-09-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2025-48581",
"datePublished": "2025-09-04T18:34:41.808Z",
"dateReserved": "2025-05-22T18:11:49.136Z",
"dateUpdated": "2025-11-04T14:20:25.197Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48543 (GCVE-0-2025-48543)
Vulnerability from nvd
Published
2025-09-04 18:34
Modified
2025-10-21 22:45
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Elevation of privilege
Summary
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-48543",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-05T03:55:51.024496Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-09-04",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48543"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T22:45:18.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48543"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-04T00:00:00+00:00",
"value": "CVE-2025-48543 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
},
{
"status": "affected",
"version": "13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-04T18:34:22.655Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/art/+/444fc40dfb04d2ec5f74c443ed3a4dd45d3131f2"
},
{
"url": "https://source.android.com/security/bulletin/2025-09-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2025-48543",
"datePublished": "2025-09-04T18:34:22.655Z",
"dateReserved": "2025-05-22T18:11:18.276Z",
"dateUpdated": "2025-10-21T22:45:18.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-20749 (GCVE-0-2025-20749)
Vulnerability from cvelistv5
Published
2025-11-04 06:20
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-121 - Stack Overflow
Summary
In charger, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915493; Issue ID: MSV-3800.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT6789, MT6835, MT6855, MT6878, MT6879, MT6886, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT8169, MT8188, MT8195, MT8196, MT8781, MT8796 |
Version: Android 14.0, 15.0, 16.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20749",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:28.632Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT6789, MT6835, MT6855, MT6878, MT6879, MT6886, MT6897, MT6899, MT6983, MT6985, MT6989, MT6991, MT8169, MT8188, MT8195, MT8196, MT8781, MT8796",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 14.0, 15.0, 16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In charger, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS09915493; Issue ID: MSV-3800."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:20:51.979Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20749",
"datePublished": "2025-11-04T06:20:51.979Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:28.632Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20747 (GCVE-0-2025-20747)
Vulnerability from cvelistv5
Published
2025-11-04 06:20
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-121 - Stack Overflow
Summary
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT2718, MT2737, MT6835, MT6878, MT6886, MT6897, MT6899, MT6982, MT6985, MT6986, MT6986D, MT6989, MT6990, MT6991, MT8676, MT8678, MT8755, MT8893 |
Version: Android 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 / Zephyr 3.7.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20747",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:31.133Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT2737, MT6835, MT6878, MT6886, MT6897, MT6899, MT6982, MT6985, MT6986, MT6986D, MT6989, MT6990, MT6991, MT8676, MT8678, MT8755, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 / Zephyr 3.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010443; Issue ID: MSV-3966."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:20:19.607Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20747",
"datePublished": "2025-11-04T06:20:19.607Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:31.133Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20746 (GCVE-0-2025-20746)
Vulnerability from cvelistv5
Published
2025-11-04 06:20
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-121 - Stack Overflow
Summary
In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT2718, MT2737, MT6835, MT6878, MT6886, MT6897, MT6899, MT6982, MT6985, MT6986, MT6986D, MT6989, MT6990, MT6991, MT8676, MT8678, MT8755, MT8893 |
Version: Android 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 / Zephyr 3.7.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20746",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:32.792Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT2737, MT6835, MT6878, MT6886, MT6897, MT6899, MT6982, MT6985, MT6986, MT6986D, MT6989, MT6990, MT6991, MT8676, MT8678, MT8755, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 14.0, 15.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 / Zephyr 3.7.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In gnss service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10010441; Issue ID: MSV-3967."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-121",
"description": "CWE-121 Stack Overflow",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:20:17.860Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20746",
"datePublished": "2025-11-04T06:20:17.860Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:32.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20745 (GCVE-0-2025-20745)
Vulnerability from cvelistv5
Published
2025-11-04 06:20
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-416 - Use After Free
Summary
In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10095441; Issue ID: MSV-4294.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT2718, MT6989, MT6991, MT8370, MT8390, MT8395, MT8676, MT8678, MT87920 |
Version: Android 13.0, 14.0, 15.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20745",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:47.647Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT6989, MT6991, MT8370, MT8390, MT8395, MT8676, MT8678, MT87920",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 13.0, 14.0, 15.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In apusys, there is a possible memory corruption due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10095441; Issue ID: MSV-4294."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:20:03.095Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20745",
"datePublished": "2025-11-04T06:20:03.095Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:47.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20744 (GCVE-0-2025-20744)
Vulnerability from cvelistv5
Published
2025-11-04 06:19
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-416 - Use After Free
Summary
In pda, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10127160; Issue ID: MSV-4542.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT6899, MT6991, MT8793 |
Version: Android 13.0, 14.0, 15.0, 16.0 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20744",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:45.818Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT6899, MT6991, MT8793",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 13.0, 14.0, 15.0, 16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In pda, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10127160; Issue ID: MSV-4542."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:19:59.710Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20744",
"datePublished": "2025-11-04T06:19:59.710Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:45.818Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20743 (GCVE-0-2025-20743)
Vulnerability from cvelistv5
Published
2025-11-04 06:19
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-416 - Use After Free
Summary
In clkdbg, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10136671; Issue ID: MSV-4651.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20743",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:44.828Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2718, MT6761, MT6765, MT6768, MT6781, MT6853, MT6877, MT6886, MT6893, MT6897, MT6899, MT6983, MT6989, MT6991, MT8113, MT8163, MT8168, MT8169, MT8183, MT8186, MT8188, MT8195, MT8196, MT8321, MT8365, MT8385, MT8390, MT8391, MT8512, MT8516, MT8519, MT8676, MT8678, MT8695, MT8696, MT8698, MT8755, MT8766, MT8768, MT8771, MT8775, MT8781, MT8786, MT8788E, MT8791T, MT8792, MT8793, MT8796, MT8797, MT8798, MT8873, MT8883, MT8893",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 14.0, 15.0, 16.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In clkdbg, there is a possible escalation of privilege due to use after free. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10136671; Issue ID: MSV-4651."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:19:57.990Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20743",
"datePublished": "2025-11-04T06:19:57.990Z",
"dateReserved": "2024-11-01T01:21:50.396Z",
"dateUpdated": "2025-11-05T04:55:44.828Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-20730 (GCVE-0-2025-20730)
Vulnerability from cvelistv5
Published
2025-11-04 06:19
Modified
2025-11-05 04:55
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-287 - Improper Authentication - Generic
Summary
In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10068463; Issue ID: MSV-4141.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| MediaTek, Inc. | MT2737, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6990, MT6991, MT8188, MT8195, MT8676, MT8678, MT8696 |
Version: Android 13.0, 14.0, 15.0, 16.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-20730",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-11-04T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-11-05T04:55:40.432Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "MT2737, MT6739, MT6761, MT6765, MT6768, MT6781, MT6789, MT6833, MT6835, MT6853, MT6855, MT6877, MT6878, MT6879, MT6883, MT6885, MT6886, MT6889, MT6893, MT6895, MT6897, MT6899, MT6983, MT6985, MT6989, MT6990, MT6991, MT8188, MT8195, MT8676, MT8678, MT8696",
"vendor": "MediaTek, Inc.",
"versions": [
{
"status": "affected",
"version": "Android 13.0, 14.0, 15.0, 16.0 / openWRT 21.02, 23.05 / Yocto 4.0 / RDK-B 24Q1"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10068463; Issue ID: MSV-4141."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-287",
"description": "CWE-287 Improper Authentication - Generic",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T06:19:47.152Z",
"orgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"shortName": "MediaTek"
},
"references": [
{
"url": "https://corp.mediatek.com/product-security-bulletin/November-2025"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "ee979b05-11f8-4f25-a7e0-a1fa9c190374",
"assignerShortName": "MediaTek",
"cveId": "CVE-2025-20730",
"datePublished": "2025-11-04T06:19:47.152Z",
"dateReserved": "2024-11-01T01:21:50.393Z",
"dateUpdated": "2025-11-05T04:55:40.432Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11720 (GCVE-0-2025-11720)
Vulnerability from cvelistv5
Published
2025-10-14 12:27
Modified
2025-10-30 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
The Firefox and Firefox Focus UI for the Android custom tab feature only showed the "site" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability affects Firefox < 144.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-11720",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T13:18:34.454167Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T13:19:42.977Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "144",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Michel Le Bihan"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "The Firefox and Firefox Focus UI for the Android custom tab feature only showed the \"site\" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability affects Firefox \u003c 144."
}
],
"value": "The Firefox and Firefox Focus UI for the Android custom tab feature only showed the \"site\" that was loaded, not the full hostname. User supplied content hosted on a subdomain of a site could have been used to fool a user into thinking it was content from a different subdomain of that site. This vulnerability affects Firefox \u003c 144."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T16:13:59.755Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1979534"
},
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1984370"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-81/"
}
],
"title": "Spoofing risk in Android custom tabs"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-11720",
"datePublished": "2025-10-14T12:27:38.204Z",
"dateReserved": "2025-10-13T19:50:22.446Z",
"dateUpdated": "2025-10-30T16:13:59.755Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11718 (GCVE-0-2025-11718)
Vulnerability from cvelistv5
Published
2025-10-14 12:27
Modified
2025-10-30 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event This vulnerability affects Firefox < 144.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-11718",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T13:20:18.439705Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-451",
"description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T13:24:40.568Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "144",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Hafiizh \u0026 kang ali"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event This vulnerability affects Firefox \u003c 144."
}
],
"value": "When the address bar was hidden due to scrolling on Android, a malicious page could create a fake address bar to fool the user in response to a visibilitychange event This vulnerability affects Firefox \u003c 144."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T16:13:52.906Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1980808"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-81/"
}
],
"title": "Address bar could be spoofed on Android using visibilitychange"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-11718",
"datePublished": "2025-10-14T12:27:37.866Z",
"dateReserved": "2025-10-13T19:50:18.353Z",
"dateUpdated": "2025-10-30T16:13:52.906Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11717 (GCVE-0-2025-11717)
Vulnerability from cvelistv5
Published
2025-10-14 12:27
Modified
2025-10-30 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability affects Firefox < 144.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-11717",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T13:20:29.623113Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T13:24:29.948Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "144",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "msd"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability affects Firefox \u003c 144."
}
],
"value": "When switching between Android apps using the card carousel Firefox shows a black screen as its card image when a password-related screen was the last one being used. Prior to Firefox 144 the password edit screen was visible. This vulnerability affects Firefox \u003c 144."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T16:13:50.048Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1872601"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-81/"
}
],
"title": "The password edit screen was not hidden in Android card view"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-11717",
"datePublished": "2025-10-14T12:27:37.569Z",
"dateReserved": "2025-10-13T19:50:16.067Z",
"dateUpdated": "2025-10-30T16:13:50.048Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-11716 (GCVE-0-2025-11716)
Vulnerability from cvelistv5
Published
2025-10-14 12:27
Modified
2025-10-30 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
Links in a sandboxed iframe could open an external app on Android without the required "allow-" permission. This vulnerability affects Firefox < 144 and Thunderbird < 144.
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Mozilla | Firefox |
Version: unspecified < 144 |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-11716",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-10-15T13:21:06.795633Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-15T13:25:37.843Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "144",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
},
{
"product": "Thunderbird",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "144",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Axel Chong (@Haxatron)"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Links in a sandboxed iframe could open an external app on Android without the required \"allow-\" permission. This vulnerability affects Firefox \u003c 144 and Thunderbird \u003c 144."
}
],
"value": "Links in a sandboxed iframe could open an external app on Android without the required \"allow-\" permission. This vulnerability affects Firefox \u003c 144 and Thunderbird \u003c 144."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T16:13:47.442Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1818679"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-81/"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-84/"
}
],
"title": "Sandboxed iframes allowed links to open in external apps (Android only)"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-11716",
"datePublished": "2025-10-14T12:27:36.531Z",
"dateReserved": "2025-10-13T19:50:13.788Z",
"dateUpdated": "2025-10-30T16:13:47.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48581 (GCVE-0-2025-48581)
Vulnerability from cvelistv5
Published
2025-09-04 18:34
Modified
2025-11-04 14:20
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Elevation of privilege
Summary
In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates through mainline installations due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-48581",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-05T03:55:51.910844Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-754",
"description": "CWE-754 Improper Check for Unusual or Exceptional Conditions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-11-04T14:20:25.197Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "16"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In VerifyNoOverlapInSessions of apexd.cpp, there is a possible way to block security updates through mainline installations due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-04T18:34:41.808Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://source.android.com/security/bulletin/2025-09-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2025-48581",
"datePublished": "2025-09-04T18:34:41.808Z",
"dateReserved": "2025-05-22T18:11:49.136Z",
"dateUpdated": "2025-11-04T14:20:25.197Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-48543 (GCVE-0-2025-48543)
Vulnerability from cvelistv5
Published
2025-09-04 18:34
Modified
2025-10-21 22:45
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- Elevation of privilege
Summary
In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
References
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-48543",
"options": [
{
"Exploitation": "active"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-05T03:55:51.024496Z",
"version": "2.0.3"
},
"type": "ssvc"
}
},
{
"other": {
"content": {
"dateAdded": "2025-09-04",
"reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48543"
},
"type": "kev"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-416",
"description": "CWE-416 Use After Free",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-10-21T22:45:18.649Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"government-resource"
],
"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48543"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-09-04T00:00:00+00:00",
"value": "CVE-2025-48543 added to CISA KEV"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Android",
"vendor": "Google",
"versions": [
{
"status": "affected",
"version": "16"
},
{
"status": "affected",
"version": "15"
},
{
"status": "affected",
"version": "14"
},
{
"status": "affected",
"version": "13"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Elevation of privilege",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-04T18:34:22.655Z",
"orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"shortName": "google_android"
},
"references": [
{
"url": "https://android.googlesource.com/platform/art/+/444fc40dfb04d2ec5f74c443ed3a4dd45d3131f2"
},
{
"url": "https://source.android.com/security/bulletin/2025-09-01"
}
],
"x_generator": {
"engine": "cvelib 1.7.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
"assignerShortName": "google_android",
"cveId": "CVE-2025-48543",
"datePublished": "2025-09-04T18:34:22.655Z",
"dateReserved": "2025-05-22T18:11:18.276Z",
"dateUpdated": "2025-10-21T22:45:18.649Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-6431 (GCVE-0-2025-6431)
Vulnerability from cvelistv5
Published
2025-06-24 12:28
Modified
2025-10-30 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 140.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-6431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-25T12:33:35.223114Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-285",
"description": "CWE-285 Improper Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T12:41:56.162Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Umar Farooq"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. \u003cbr\u003e*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox \u003c 140."
}
],
"value": "When a link can be opened in an external application, Firefox for Android will, by default, prompt the user before doing so. An attacker could have bypassed this prompt, potentially exposing the user to security vulnerabilities or privacy leaks in external applications. \n*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox \u003c 140."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T16:13:28.180Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1942716"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-51/"
}
],
"title": "The prompt in Firefox for Android that asks before opening a link in an external application could be bypassed"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-6431",
"datePublished": "2025-06-24T12:28:03.475Z",
"dateReserved": "2025-06-20T14:51:36.769Z",
"dateUpdated": "2025-10-30T16:13:28.180Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-6428 (GCVE-0-2025-6428)
Vulnerability from cvelistv5
Published
2025-06-24 12:28
Modified
2025-10-30 16:13
Severity ?
VLAI Severity ?
EPSS score ?
Summary
When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks.
*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox < 140.
References
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-6428",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-06-25T14:20:42.338589Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-06-25T14:26:41.191Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "Firefox",
"vendor": "Mozilla",
"versions": [
{
"lessThan": "140",
"status": "affected",
"version": "unspecified",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Raul Bucata"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks.\u003cbr\u003e*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox \u003c 140."
}
],
"value": "When a URL was provided in a link querystring parameter, Firefox for Android would follow that URL instead of the correct URL, potentially leading to phishing attacks.\n*This bug only affects Firefox for Android. Other versions of Firefox are unaffected.* This vulnerability affects Firefox \u003c 140."
}
],
"providerMetadata": {
"dateUpdated": "2025-10-30T16:13:24.727Z",
"orgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"shortName": "mozilla"
},
"references": [
{
"url": "https://bugzilla.mozilla.org/show_bug.cgi?id=1970151"
},
{
"url": "https://www.mozilla.org/security/advisories/mfsa2025-51/"
}
],
"title": "Firefox for Android opened URLs specified in a link querystring parameter"
}
},
"cveMetadata": {
"assignerOrgId": "f16b083a-5664-49f3-a51e-8d479e5ed7fe",
"assignerShortName": "mozilla",
"cveId": "CVE-2025-6428",
"datePublished": "2025-06-24T12:28:02.201Z",
"dateReserved": "2025-06-20T14:51:33.064Z",
"dateUpdated": "2025-10-30T16:13:24.727Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CERTFR-2025-AVI-0750
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Google Android. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Google indique que les vulnérabilités CVE-2025-38352 et CVE-2025-48543 sont activement exploitées.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Android versions ant\u00e9rieures \u00e0 13, 14, 15 et 16 avant le correctif du 2 septembre 2025",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-48534",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48534"
},
{
"name": "CVE-2025-47326",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47326"
},
{
"name": "CVE-2025-48531",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48531"
},
{
"name": "CVE-2025-32323",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32323"
},
{
"name": "CVE-2025-21487",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21487"
},
{
"name": "CVE-2025-48544",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48544"
},
{
"name": "CVE-2025-27065",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27065"
},
{
"name": "CVE-2025-48541",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48541"
},
{
"name": "CVE-2025-3212",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-3212"
},
{
"name": "CVE-2025-47328",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47328"
},
{
"name": "CVE-2025-21433",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21433"
},
{
"name": "CVE-2025-27034",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27034"
},
{
"name": "CVE-2025-8109",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8109"
},
{
"name": "CVE-2025-21481",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21481"
},
{
"name": "CVE-2025-48535",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48535"
},
{
"name": "CVE-2025-48527",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48527"
},
{
"name": "CVE-2025-27032",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27032"
},
{
"name": "CVE-2025-48539",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48539"
},
{
"name": "CVE-2025-48540",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48540"
},
{
"name": "CVE-2025-47317",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47317"
},
{
"name": "CVE-2025-32333",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32333"
},
{
"name": "CVE-2025-21465",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21465"
},
{
"name": "CVE-2025-25180",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25180"
},
{
"name": "CVE-2025-48563",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48563"
},
{
"name": "CVE-2025-48526",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48526"
},
{
"name": "CVE-2025-27052",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27052"
},
{
"name": "CVE-2025-48538",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48538"
},
{
"name": "CVE-2025-20703",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20703"
},
{
"name": "CVE-2025-21482",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21482"
},
{
"name": "CVE-2025-21755",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21755"
},
{
"name": "CVE-2024-7881",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-7881"
},
{
"name": "CVE-2025-48556",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48556"
},
{
"name": "CVE-2025-27043",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27043"
},
{
"name": "CVE-2025-21464",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21464"
},
{
"name": "CVE-2025-20696",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20696"
},
{
"name": "CVE-2025-21449",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21449"
},
{
"name": "CVE-2025-0076",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0076"
},
{
"name": "CVE-2025-1246",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1246"
},
{
"name": "CVE-2025-26454",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26454"
},
{
"name": "CVE-2025-21427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21427"
},
{
"name": "CVE-2025-32347",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32347"
},
{
"name": "CVE-2025-47329",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47329"
},
{
"name": "CVE-2025-21483",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21483"
},
{
"name": "CVE-2025-21446",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21446"
},
{
"name": "CVE-2025-32325",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32325"
},
{
"name": "CVE-2025-25179",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25179"
},
{
"name": "CVE-2021-39810",
"url": "https://www.cve.org/CVERecord?id=CVE-2021-39810"
},
{
"name": "CVE-2025-48528",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48528"
},
{
"name": "CVE-2025-32349",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32349"
},
{
"name": "CVE-2025-32345",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32345"
},
{
"name": "CVE-2025-48524",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48524"
},
{
"name": "CVE-2025-21432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21432"
},
{
"name": "CVE-2025-48542",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48542"
},
{
"name": "CVE-2025-48522",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48522"
},
{
"name": "CVE-2025-32331",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32331"
},
{
"name": "CVE-2025-48546",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48546"
},
{
"name": "CVE-2025-48581",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48581"
},
{
"name": "CVE-2025-48551",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48551"
},
{
"name": "CVE-2025-27061",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27061"
},
{
"name": "CVE-2024-49714",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49714"
},
{
"name": "CVE-2025-48547",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48547"
},
{
"name": "CVE-2025-48537",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48537"
},
{
"name": "CVE-2025-0467",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0467"
},
{
"name": "CVE-2025-46708",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46708"
},
{
"name": "CVE-2025-47318",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-47318"
},
{
"name": "CVE-2025-21450",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21450"
},
{
"name": "CVE-2025-48550",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48550"
},
{
"name": "CVE-2025-021701",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-021701"
},
{
"name": "CVE-2025-48561",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48561"
},
{
"name": "CVE-2025-48553",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48553"
},
{
"name": "CVE-2025-27042",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27042"
},
{
"name": "CVE-2025-48554",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48554"
},
{
"name": "CVE-2025-48549",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48549"
},
{
"name": "CVE-2025-21477",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21477"
},
{
"name": "CVE-2025-48529",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48529"
},
{
"name": "CVE-2025-46710",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46710"
},
{
"name": "CVE-2025-32327",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32327"
},
{
"name": "CVE-2024-47899",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47899"
},
{
"name": "CVE-2025-32332",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32332"
},
{
"name": "CVE-2025-48560",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48560"
},
{
"name": "CVE-2025-48559",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48559"
},
{
"name": "CVE-2025-1706",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-1706"
},
{
"name": "CVE-2025-0089",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0089"
},
{
"name": "CVE-2023-24023",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-24023"
},
{
"name": "CVE-2025-32330",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32330"
},
{
"name": "CVE-2025-32326",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32326"
},
{
"name": "CVE-2025-27056",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27056"
},
{
"name": "CVE-2025-21488",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21488"
},
{
"name": "CVE-2025-38352",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-38352"
},
{
"name": "CVE-2025-32324",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32324"
},
{
"name": "CVE-2025-27057",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27057"
},
{
"name": "CVE-2025-48532",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48532"
},
{
"name": "CVE-2025-27066",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27066"
},
{
"name": "CVE-2025-48552",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48552"
},
{
"name": "CVE-2024-47898",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47898"
},
{
"name": "CVE-2025-48545",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48545"
},
{
"name": "CVE-2025-27073",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27073"
},
{
"name": "CVE-2025-32350",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32350"
},
{
"name": "CVE-2025-21484",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21484"
},
{
"name": "CVE-2025-48523",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48523"
},
{
"name": "CVE-2025-48543",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48543"
},
{
"name": "CVE-2025-48562",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48562"
},
{
"name": "CVE-2025-32321",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32321"
},
{
"name": "CVE-2025-26464",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26464"
},
{
"name": "CVE-2025-32346",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32346"
},
{
"name": "CVE-2025-20704",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20704"
},
{
"name": "CVE-2025-48548",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48548"
},
{
"name": "CVE-2025-21454",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21454"
},
{
"name": "CVE-2025-46707",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-46707"
},
{
"name": "CVE-2025-20708",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20708"
},
{
"name": "CVE-2025-48558",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-48558"
}
],
"initial_release_date": "2025-09-03T00:00:00",
"last_revision_date": "2025-09-03T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0750",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-09-03T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nGoogle indique que les vuln\u00e9rabilit\u00e9s CVE-2025-38352 et CVE-2025-48543 sont activement exploit\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": "2025-09-01",
"title": "Bulletin de s\u00e9curit\u00e9 Google Android",
"url": "https://source.android.com/docs/security/bulletin/2025-09-01?hl=fr"
}
]
}
CERTFR-2025-AVI-0511
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Google. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | ||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Android 16 sans les correctifs du 10 juin 2025",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
},
{
"description": "Pixel sans les correctifs de s\u00e9curit\u00e9 du 10 juin 2025",
"product": {
"name": "Pixel",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-26460",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26460"
},
{
"name": "CVE-2025-36887",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-36887"
},
{
"name": "CVE-2025-32338",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32338"
},
{
"name": "CVE-2024-48883",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-48883"
},
{
"name": "CVE-2025-32314",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32314"
},
{
"name": "CVE-2025-32316",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32316"
},
{
"name": "CVE-2025-26785",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26785"
},
{
"name": "CVE-2025-32340",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32340"
},
{
"name": "CVE-2025-32320",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32320"
},
{
"name": "CVE-2025-32339",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32339"
},
{
"name": "CVE-2025-26459",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26459"
},
{
"name": "CVE-2025-32315",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32315"
},
{
"name": "CVE-2025-26461",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26461"
},
{
"name": "CVE-2025-32334",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32334"
},
{
"name": "CVE-2024-0028",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0028"
},
{
"name": "CVE-2024-56427",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56427"
},
{
"name": "CVE-2025-32337",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32337"
},
{
"name": "CVE-2025-26457",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26457"
},
{
"name": "CVE-2025-32336",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32336"
},
{
"name": "CVE-2025-32317",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32317"
},
{
"name": "CVE-2025-32335",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32335"
},
{
"name": "CVE-2025-32318",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32318"
},
{
"name": "CVE-2025-26434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26434"
}
],
"initial_release_date": "2025-06-13T00:00:00",
"last_revision_date": "2025-06-13T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0511",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-06-13T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Google. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Google",
"vendor_advisories": [
{
"published_at": "2025-06-10",
"title": "Bulletin de s\u00e9curit\u00e9 Google Android",
"url": "https://source.android.com/docs/security/bulletin/android-16?hl=fr"
},
{
"published_at": "2025-06-10",
"title": "Bulletin de s\u00e9curit\u00e9 Google Pixel",
"url": "https://source.android.com/docs/security/bulletin/pixel/2025-06-01?hl=fr"
}
]
}
CERTFR-2025-AVI-0472
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans les produits Google. Elles permettent à un attaquant de provoquer une élévation de privilèges, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Android versions ant\u00e9rieures \u00e0 13, 14 et 15 avant le correctif du 2 juin 2025",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-26443",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26443"
},
{
"name": "CVE-2025-26452",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26452"
},
{
"name": "CVE-2025-21485",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21485"
},
{
"name": "CVE-2025-26448",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26448"
},
{
"name": "CVE-2025-21424",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21424"
},
{
"name": "CVE-2025-26449",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26449"
},
{
"name": "CVE-2024-12576",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12576"
},
{
"name": "CVE-2025-26450",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26450"
},
{
"name": "CVE-2025-26437",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26437"
},
{
"name": "CVE-2025-25178",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-25178"
},
{
"name": "CVE-2025-26463",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26463"
},
{
"name": "CVE-2024-53020",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53020"
},
{
"name": "CVE-2025-0819",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0819"
},
{
"name": "CVE-2025-26432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26432"
},
{
"name": "CVE-2024-47893",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47893"
},
{
"name": "CVE-2025-0478",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0478"
},
{
"name": "CVE-2024-12837",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12837"
},
{
"name": "CVE-2024-53026",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53026"
},
{
"name": "CVE-2025-27029",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27029"
},
{
"name": "CVE-2025-0073",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0073"
},
{
"name": "CVE-2025-26453",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26453"
},
{
"name": "CVE-2025-21486",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21486"
},
{
"name": "CVE-2025-26455",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26455"
},
{
"name": "CVE-2024-53019",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53019"
},
{
"name": "CVE-2024-53010",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53010"
},
{
"name": "CVE-2025-32312",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-32312"
},
{
"name": "CVE-2025-26456",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26456"
},
{
"name": "CVE-2025-0835",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0835"
},
{
"name": "CVE-2025-26441",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26441"
},
{
"name": "CVE-2024-53021",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53021"
},
{
"name": "CVE-2025-26462",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26462"
},
{
"name": "CVE-2025-26445",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26445"
},
{
"name": "CVE-2025-26458",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26458"
},
{
"name": "CVE-2025-0468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0468"
}
],
"initial_release_date": "2025-06-03T00:00:00",
"last_revision_date": "2025-06-03T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0472",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-06-03T00:00:00.000000"
}
],
"risks": [
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Google. Elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": "2025-06-02",
"title": "Bulletin de s\u00e9curit\u00e9 Google Android",
"url": "https://source.android.com/docs/security/bulletin/2025-06-01?hl=fr"
}
]
}
CERTFR-2025-AVI-0371
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Google Android. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Google indique que la vulnérabilité CVE-2025-27363 est activement exploitée.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Android versions ant\u00e9rieures \u00e0 13, 14 et 15 avant le correctif du 5 mai 2025",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-49739",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49739"
},
{
"name": "CVE-2025-26428",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26428"
},
{
"name": "CVE-2025-26429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26429"
},
{
"name": "CVE-2024-12577",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-12577"
},
{
"name": "CVE-2025-26425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26425"
},
{
"name": "CVE-2024-49835",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49835"
},
{
"name": "CVE-2025-26424",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26424"
},
{
"name": "CVE-2025-21459",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21459"
},
{
"name": "CVE-2024-47900",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47900"
},
{
"name": "CVE-2024-47891",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47891"
},
{
"name": "CVE-2025-26422",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26422"
},
{
"name": "CVE-2024-34739",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-34739"
},
{
"name": "CVE-2025-0077",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0077"
},
{
"name": "CVE-2024-49846",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49846"
},
{
"name": "CVE-2025-26442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26442"
},
{
"name": "CVE-2025-21453",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21453"
},
{
"name": "CVE-2024-49841",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49841"
},
{
"name": "CVE-2025-26421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26421"
},
{
"name": "CVE-2024-52939",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52939"
},
{
"name": "CVE-2024-45580",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45580"
},
{
"name": "CVE-2025-26436",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26436"
},
{
"name": "CVE-2025-26430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26430"
},
{
"name": "CVE-2024-49847",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49847"
},
{
"name": "CVE-2024-46974",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-46974"
},
{
"name": "CVE-2025-26435",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26435"
},
{
"name": "CVE-2025-26423",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26423"
},
{
"name": "CVE-2025-21468",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21468"
},
{
"name": "CVE-2025-22425",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22425"
},
{
"name": "CVE-2024-49845",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49845"
},
{
"name": "CVE-2025-26420",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26420"
},
{
"name": "CVE-2024-47896",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47896"
},
{
"name": "CVE-2024-46975",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-46975"
},
{
"name": "CVE-2023-21342",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21342"
},
{
"name": "CVE-2025-21467",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21467"
},
{
"name": "CVE-2025-26444",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26444"
},
{
"name": "CVE-2024-49842",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49842"
},
{
"name": "CVE-2025-27363",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-27363"
},
{
"name": "CVE-2025-0072",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0072"
},
{
"name": "CVE-2025-0087",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0087"
},
{
"name": "CVE-2023-35657",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-35657"
},
{
"name": "CVE-2025-0427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0427"
},
{
"name": "CVE-2025-26440",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26440"
},
{
"name": "CVE-2025-20666",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20666"
},
{
"name": "CVE-2025-26438",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26438"
},
{
"name": "CVE-2025-26427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26427"
},
{
"name": "CVE-2025-26426",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26426"
}
],
"initial_release_date": "2025-05-06T00:00:00",
"last_revision_date": "2025-05-06T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0371",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-05-06T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nGoogle indique que la vuln\u00e9rabilit\u00e9 CVE-2025-27363 est activement exploit\u00e9e.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": "2025-05-05",
"title": "Bulletin de s\u00e9curit\u00e9 Google Android",
"url": "https://source.android.com/docs/security/bulletin/2025-05-01?hl=fr"
}
]
}
CERTFR-2025-AVI-0281
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Google Android. Certaines d'entre elles permettent à un attaquant de provoquer une élévation de privilèges, une atteinte à la confidentialité des données et un déni de service. Google indique que les vulnérabilités CVE-2024-53150 et CVE-2024-53197 sont activement exploitées.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Android versions ant\u00e9rieures \u00e0 13, 14 et 15 avant le correctif du 7 avril 2025",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2024-45549",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45549"
},
{
"name": "CVE-2024-52937",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52937"
},
{
"name": "CVE-2025-22422",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22422"
},
{
"name": "CVE-2024-47895",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47895"
},
{
"name": "CVE-2024-43065",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43065"
},
{
"name": "CVE-2024-45551",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45551"
},
{
"name": "CVE-2025-22433",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22433"
},
{
"name": "CVE-2025-26416",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26416"
},
{
"name": "CVE-2024-43066",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43066"
},
{
"name": "CVE-2025-21429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21429"
},
{
"name": "CVE-2024-43703",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43703"
},
{
"name": "CVE-2024-53150",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53150"
},
{
"name": "CVE-2024-46972",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-46972"
},
{
"name": "CVE-2024-49848",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49848"
},
{
"name": "CVE-2025-22416",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22416"
},
{
"name": "CVE-2024-45552",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45552"
},
{
"name": "CVE-2025-22438",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22438"
},
{
"name": "CVE-2024-56556",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-56556"
},
{
"name": "CVE-2024-52938",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52938"
},
{
"name": "CVE-2025-22442",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22442"
},
{
"name": "CVE-2024-53197",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53197"
},
{
"name": "CVE-2025-22427",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22427"
},
{
"name": "CVE-2025-22418",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22418"
},
{
"name": "CVE-2025-22439",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22439"
},
{
"name": "CVE-2024-47894",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47894"
},
{
"name": "CVE-2025-22435",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22435"
},
{
"name": "CVE-2025-22437",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22437"
},
{
"name": "CVE-2024-50264",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-50264"
},
{
"name": "CVE-2025-22429",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22429"
},
{
"name": "CVE-2025-22434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22434"
},
{
"name": "CVE-2024-52936",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-52936"
},
{
"name": "CVE-2025-22430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22430"
},
{
"name": "CVE-2024-49730",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49730"
},
{
"name": "CVE-2025-22432",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22432"
},
{
"name": "CVE-2025-22426",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22426"
},
{
"name": "CVE-2025-0050",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0050"
},
{
"name": "CVE-2025-21430",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21430"
},
{
"name": "CVE-2025-20657",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20657"
},
{
"name": "CVE-2025-20655",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20655"
},
{
"name": "CVE-2025-22423",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22423"
},
{
"name": "CVE-2024-49722",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49722"
},
{
"name": "CVE-2024-49720",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49720"
},
{
"name": "CVE-2025-20656",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20656"
},
{
"name": "CVE-2024-43702",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43702"
},
{
"name": "CVE-2025-22431",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22431"
},
{
"name": "CVE-2024-47897",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-47897"
},
{
"name": "CVE-2025-21435",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21435"
},
{
"name": "CVE-2025-22419",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22419"
},
{
"name": "CVE-2025-21436",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21436"
},
{
"name": "CVE-2025-21434",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21434"
},
{
"name": "CVE-2024-40653",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-40653"
},
{
"name": "CVE-2025-22421",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22421"
},
{
"name": "CVE-2025-20658",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20658"
},
{
"name": "CVE-2025-21448",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-21448"
},
{
"name": "CVE-2025-22428",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22428"
},
{
"name": "CVE-2024-49728",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49728"
},
{
"name": "CVE-2025-22424",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22424"
},
{
"name": "CVE-2024-33058",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-33058"
},
{
"name": "CVE-2025-22417",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22417"
}
],
"initial_release_date": "2025-04-08T00:00:00",
"last_revision_date": "2025-04-08T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0281",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-04-08T00:00:00.000000"
}
],
"risks": [
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et un d\u00e9ni de service.\nGoogle indique que les vuln\u00e9rabilit\u00e9s CVE-2024-53150 et CVE-2024-53197 sont activement exploit\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": "2025-04-07",
"title": "Bulletin de s\u00e9curit\u00e9 Google Android",
"url": "https://source.android.com/docs/security/bulletin/2025-04-01?hl=fr"
}
]
}
CERTFR-2025-AVI-0172
Vulnerability from certfr_avis
De multiples vulnérabilités ont été découvertes dans Google Android. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.
Google indique que les vulnérabilités CVE-2024-43093 et CVE-2024-50302 sont exploitées dans le cadre d'attaques ciblées.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
References
| Title | Publication Time | Tags | |||
|---|---|---|---|---|---|
|
|||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Android versions ant\u00e9rieures \u00e0 12, 12L, 13, 14 et 15 avant le correctif du 3 mars 2025",
"product": {
"name": "Android",
"vendor": {
"name": "Google",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-22406",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22406"
},
{
"name": "CVE-2025-22409",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22409"
},
{
"name": "CVE-2025-22413",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22413"
},
{
"name": "CVE-2024-53025",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53025"
},
{
"name": "CVE-2024-0032",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-0032"
},
{
"name": "CVE-2025-20644",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20644"
},
{
"name": "CVE-2025-0084",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0084"
},
{
"name": "CVE-2025-0080",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0080"
},
{
"name": "CVE-2025-0092",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0092"
},
{
"name": "CVE-2024-50302",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-50302"
},
{
"name": "CVE-2025-22403",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22403"
},
{
"name": "CVE-2025-22411",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22411"
},
{
"name": "CVE-2024-53014",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53014"
},
{
"name": "CVE-2024-49836",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49836"
},
{
"name": "CVE-2025-22412",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22412"
},
{
"name": "CVE-2025-22410",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22410"
},
{
"name": "CVE-2025-0078",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0078"
},
{
"name": "CVE-2025-0093",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0093"
},
{
"name": "CVE-2024-53011",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53011"
},
{
"name": "CVE-2025-22405",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22405"
},
{
"name": "CVE-2025-22407",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22407"
},
{
"name": "CVE-2025-0086",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0086"
},
{
"name": "CVE-2025-22408",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22408"
},
{
"name": "CVE-2024-53024",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53024"
},
{
"name": "CVE-2024-43090",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43090"
},
{
"name": "CVE-2024-43093",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43093"
},
{
"name": "CVE-2024-49740",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49740"
},
{
"name": "CVE-2025-0079",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0079"
},
{
"name": "CVE-2025-0083",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0083"
},
{
"name": "CVE-2025-0074",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0074"
},
{
"name": "CVE-2025-0075",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0075"
},
{
"name": "CVE-2025-0082",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0082"
},
{
"name": "CVE-2024-46852",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-46852"
},
{
"name": "CVE-2025-0081",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0081"
},
{
"name": "CVE-2025-22404",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-22404"
},
{
"name": "CVE-2024-53027",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-53027"
},
{
"name": "CVE-2025-26417",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-26417"
},
{
"name": "CVE-2024-43051",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-43051"
},
{
"name": "CVE-2025-0087",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-0087"
},
{
"name": "CVE-2025-20645",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-20645"
},
{
"name": "CVE-2024-49728",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49728"
},
{
"name": "CVE-2023-21125",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21125"
},
{
"name": "CVE-2024-49838",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-49838"
}
],
"initial_release_date": "2025-03-04T00:00:00",
"last_revision_date": "2025-03-04T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0172",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-03-04T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Google Android. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n\nGoogle indique que les vuln\u00e9rabilit\u00e9s CVE-2024-43093 et CVE-2024-50302 sont exploit\u00e9es dans le cadre d\u0027attaques cibl\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Google Android",
"vendor_advisories": [
{
"published_at": "2025-03-03",
"title": "Bulletin de s\u00e9curit\u00e9 Google Android",
"url": "https://source.android.com/docs/security/bulletin/2025-03-01?hl=fr"
}
]
}