Overview 273 matches · 0 in Waratek scope · 0 protected · 48 exploited · 39 CISA KEV · 27 EPSS ≥ 0.5
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
5
1.8%
Not applicable
268
98.2%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
273
100.0%
not established
0
0.0%
unrecorded
0
0.0%
Exploited
48
17.6%
Working exploit published
117
42.9%
Proof of concept only
108
39.6%
Forecast only
0
0.0%
No public exploit
0
0.0%
split by
peak 24 / year
20021
Not applicable1
Low1
not blocked1
Working exploit published1
20030
20041
Not applicable1
Medium1
not blocked1
Working exploit published1
20051
Not applicable1
High1
not blocked1
Working exploit published1
20061
Not applicable1
Medium1
not blocked1
Working exploit published1
20074
Not applicable4
High2
Medium2
not blocked4
Working exploit published4
20084
Not applicable4
High1
Medium3
not blocked4
Working exploit published4
200910
Not applicable10
High2
Medium8
not blocked10
Working exploit published10
20108
Not applicable8
Critical1
High5
Medium2
not blocked8
Exploited1
Working exploit published7
20117
Not applicable7
High2
Medium5
not blocked7
Exploited2
Working exploit published4
Proof of concept only1
201212
Not applicable12
High4
Medium7
Low1
not blocked12
Working exploit published9
Proof of concept only3
20134
Not applicable4
High3
Medium1
not blocked4
Working exploit published4
20148
Not applicable8
Critical1
High5
Medium2
not blocked8
Exploited1
Working exploit published6
Proof of concept only1
201516
Outside Waratek scope1
Not applicable15
High15
Low1
not blocked16
Exploited2
Working exploit published9
Proof of concept only5
201618
Not applicable18
Critical2
High12
Medium4
not blocked18
Exploited1
Working exploit published11
Proof of concept only6
201715
Not applicable15
Critical1
High10
Medium4
not blocked15
Exploited1
Working exploit published8
Proof of concept only6
201819
Not applicable19
High14
Medium5
not blocked19
Exploited2
Working exploit published14
Proof of concept only3
201924
Outside Waratek scope2
Not applicable22
High19
Medium5
not blocked24
Exploited6
Working exploit published15
Proof of concept only3
202022
Not applicable22
Critical3
High12
Medium7
not blocked22
Exploited3
Working exploit published6
Proof of concept only13
202114
Not applicable14
High11
Medium3
not blocked14
Exploited6
Working exploit published1
Proof of concept only7
202215
Not applicable15
Critical2
High10
Medium3
not blocked15
Exploited2
Working exploit published1
Proof of concept only12
202319
Outside Waratek scope1
Not applicable18
Critical1
High12
Medium6
not blocked19
Exploited5
Proof of concept only14
202415
Not applicable15
Critical4
High11
not blocked15
Exploited4
Proof of concept only11
202515
Not applicable15
Critical1
High10
Medium4
not blocked15
Exploited8
Proof of concept only7
202620
Outside Waratek scope1
Not applicable19
Critical4
High15
Medium1
not blocked20
Exploited4
Proof of concept only16
2002200420062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-111497 | Critical | 2026-10-22 | Outside Waratek scope | Exploited | A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1. |
| CVE-2026-91737 | High | 2026-09-15 | Not applicable | Proof of concept only | Use after free in PDF in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-87575 | Medium | 2026-09-09 | Not applicable | Proof of concept only | Incorrect authorization in Loader in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low) |
| CVE-2026-87491 | High | 2026-09-09 | Not applicable | Exploited | Out of bounds write in V8 in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2026-49881 | High | 2026-09-08 | Not applicable | Proof of concept only | In serviceClassExists of InCallController.java, there is a possible arbitrary code execution due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-28609 | High | 2026-09-08 | Not applicable | Proof of concept only | In read of MatroskaExtractor.cpp, there is a possible out-of-bounds write due to improper casting. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-85046 | High | 2026-09-03 | Not applicable | Exploited | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-14382 | Critical | 2026-07-01 | Not applicable | Proof of concept only | Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 150.0.7871.46 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-28576 | Critical | 2026-06-17 | Not applicable | Proof of concept only | In Contacts Provider, there is a possible way to access the contacts database due to SQL injection. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-10961 | High | 2026-06-04 | Not applicable | Proof of concept only | Use after free in Chrome for iOS in Google Chrome on iOS prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-0091 | High | 2026-06-01 | Not applicable | Proof of concept only | In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0075 | High | 2026-06-01 | Not applicable | Proof of concept only | In multiple functions, there is a possible way to access the contacts database due to a SQL injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0073 | High | 2026-05-04 | Not applicable | Proof of concept only | In adbd_tls_verify_cert of auth.cpp, there is a possible bypass of wireless ADB mutual authentication due to a logic error in the code. This could lead to remote (proximal/adjacent) code execution as the shell user with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-6307 | High | 2026-04-15 | Not applicable | Proof of concept only | Type Confusion in Turbofan in Google Chrome prior to 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-5865 | High | 2026-04-08 | Not applicable | Proof of concept only | Type Confusion in V8 in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2026-0047 | High | 2026-03-02 | Not applicable | Proof of concept only | In dumpBitmapsProto of ActivityManagerService.java, there is a possible way for an app to access private information due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0023 | High | 2026-03-02 | Not applicable | Proof of concept only | In createSessionInternal of PackageInstallerService.java, there is a possible way for an app to update its ownership due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-0006 | Critical | 2026-03-02 | Not applicable | Proof of concept only | In multiple locations, there is a possible out of bounds read and write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2026-2441 | High | 2026-02-13 | Not applicable | Exploited | Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2025-36911 | High | 2026-01-15 | Not applicable | Proof of concept only | In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-14174 | High | 2025-12-12 | Not applicable | Exploited | Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 143.0.7499.110 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High) |
| CVE-2025-48593 | High | 2025-11-18 | Not applicable | Proof of concept only | In bta_hf_client_cb_init of bta_hf_client_main.cc, there is a possible remote code execution due to a use after free. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-20730 | Medium | 2025-11-04 | Not applicable | Proof of concept only | In preloader, there is a possible escalation of privilege due to an insecure default value. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch ID: ALPS10068463; Issue ID: MSV-4141. |
| CVE-2025-10585 | Critical | 2025-09-24 | Not applicable | Exploited | Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2025-48561 | Medium | 2025-09-04 | Not applicable | Proof of concept only | In multiple locations, there is a possible way to access data displayed on the screen due to side channel information disclosure. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-48543 | High | 2025-09-04 | Not applicable | Exploited | In multiple locations, there is a possible way to escape chrome sandbox to attack android system_server due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-22441 | High | 2025-09-04 | Not applicable | Proof of concept only | In getContextForResourcesEnsuringCorrectCachedApkPaths of RemoteViews.java, there is a possible way to load arbitrary java code in a privileged context due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. |
| CVE-2025-0087 | Medium | 2025-09-04 | Not applicable | Proof of concept only | In onCreate of UninstallerActivity.java, there is a possible way to uninstall a different user's app due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2025-6558 | High | 2025-07-15 | Not applicable | Exploited | Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) |
| CVE-2025-6554 | High | 2025-06-30 | Not applicable | Exploited | Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: High) |
| CVE-2025-5419 | High | 2025-06-03 | Not applicable | Exploited | Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2025-31710 | High | 2025-06-03 | Not applicable | Proof of concept only | In engineermode service, there is a possible command injection due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. |
| CVE-2025-4664 | Medium | 2025-05-14 | Not applicable | Exploited | Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) |
| CVE-2025-2783 | High | 2025-03-26 | Not applicable | Exploited | Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High) |
| CVE-2018-9375 | High | 2025-01-17 | Not applicable | Proof of concept only | In multiple functions of UserDictionaryProvider.java, there is a possible way to add and delete words in the user dictionary due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2018-9468 | High | 2024-11-20 | Not applicable | Proof of concept only | In query of DownloadManager.java, there is a possible read/write of arbitrary files due to a permissions bypass. This could lead to local information disclosure and file rewriting with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2018-9411 | High | 2024-11-19 | Not applicable | Proof of concept only | In decrypt of ClearKeyCasPlugin.cpp there is a possible out-of-bounds write due to a missing bounds check. This could lead to remote arbitrary code execution with no additional execution privileges needed. User interaction is needed for exploitation. |
| CVE-2024-7971 | Critical | 2024-08-21 | Not applicable | Exploited | Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2024-7965 | High | 2024-08-21 | Not applicable | Exploited | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2024-34740 | High | 2024-08-15 | Not applicable | Proof of concept only | In attributeBytesBase64 and attributeBytesHex of BinaryXmlSerializer.java, there is a possible arbitrary XML injection due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2024-6778 | High | 2024-07-16 | Not applicable | Proof of concept only | Race in DevTools in Google Chrome prior to 126.0.6478.182 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High) |
| CVE-2024-31317 | High | 2024-07-09 | Not applicable | Proof of concept only | In multiple functions of ZygoteProcess.java, there is a possible way to achieve code execution as any app via WRITE_SECURE_SETTINGS due to unsafe deserialization. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2023-7261 | High | 2024-06-07 | Not applicable | Proof of concept only | Inappropriate implementation in Google Updator prior to 1.3.36.351 in Google Chrome allowed a local attacker to perform privilege escalation via a malicious file. (Chromium security severity: High) |
| CVE-2024-5274 | Critical | 2024-05-28 | Not applicable | Exploited | Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2024-4947 | Critical | 2024-05-15 | Not applicable | Exploited | Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High) |
| CVE-2024-2887 | High | 2024-03-26 | Not applicable | Proof of concept only | Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) |
| CVE-2024-0044 | High | 2024-03-11 | Not applicable | Proof of concept only | In createSessionInternal of PackageInstallerService.java, there is a possible run-as any app due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2024-0039 | Critical | 2024-03-11 | Not applicable | Proof of concept only | In attp_build_value_cmd of att_protocol.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2024-1939 | High | 2024-02-29 | Not applicable | Proof of concept only | Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2024-0015 | High | 2024-02-16 | Not applicable | Proof of concept only | In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2023-6702 | High | 2023-12-14 | Not applicable | Proof of concept only | Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2023-45866 | Medium | 2023-12-08 | Not applicable | Proof of concept only | Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and accept HID keyboard reports, potentially permitting injection of HID messages when no user interaction has occurred in the Central role to authorize such access. An example affected package is bluez 5.64-0ubuntu1 in Ubuntu 22.04LTS. NOTE: in some cases, a CVE-2020-0556 mitigation would have already addressed this Bluetooth HID Hosts issue. |
| CVE-2023-45779 | High | 2023-12-04 | Not applicable | Proof of concept only | In the APEX module framework of AOSP, there is a possible malicious update to platform components due to improperly used crypto. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. More details on this can be found in the referenced links. |
| CVE-2023-45777 | High | 2023-12-04 | Not applicable | Proof of concept only | In checkKeyIntentParceledCorrectly of AccountManagerService.java, there is a possible way to launch arbitrary activities using system privileges due to Parcel Mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2023-40130 | High | 2023-10-27 | Not applicable | Proof of concept only | In notifyTimeout of CallRedirectionProcessor, there is a possible permission bypass due to a logic error in the code. This could lead to local escalation of privilege and background activity launch with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2023-5217 | High | 2023-09-28 | Not applicable | Exploited | Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2023-4863 | High | 2023-09-12 | Outside Waratek scope | Exploited | Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical) |
| CVE-2023-35671 | Medium | 2023-09-11 | Not applicable | Proof of concept only | In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked screen mode due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. |
| CVE-2023-4427 | High | 2023-08-23 | Not applicable | Proof of concept only | Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High) |
| CVE-2023-4357 | High | 2023-08-15 | Not applicable | Proof of concept only | Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2023-3079 | High | 2023-06-05 | Not applicable | Exploited | Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2023-20696 | Medium | 2023-05-15 | Not applicable | Proof of concept only | In preloader, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07856356 / ALPS07874388 (For MT6880 and MT6890 only); Issue ID: ALPS07856356 / ALPS07874388 (For MT6880 and MT6890 only). |
| CVE-2023-30845 | Critical | 2023-04-26 | Not applicable | Proof of concept only | ESPv2 is a service proxy that provides API management capabilities using Google Service Infrastructure. ESPv2 2.20.0 through 2.42.0 contains an authentication bypass vulnerability. API clients can craft a malicious `X-HTTP-Method-Override` header value to bypass JWT authentication in specific cases. ESPv2 allows malicious requests to bypass authentication if both the conditions are true: The requested HTTP method is **not** in the API service definition (OpenAPI spec or gRPC `google.api.http` proto annotations, and the specified `X-HTTP-Method-Override` is a valid HTTP method in the API service definition. ESPv2 will forward the request to your backend without checking the JWT. Attackers can craft requests with a malicious `X-HTTP-Method-Override` value that allows them to bypass specifying JWTs. Restricting API access with API keys works as intended and is not affected by this vulnerability. Upgrade deployments to release v2.43.0 or higher to receive a patch. This release ensures that JWT authentication occurs, even when the caller specifies `x-http-method-override`. `x-http-method-override` is still supported by v2.43.0+. API clients can continue sending this header to ESPv2. |
| CVE-2023-2033 | High | 2023-04-14 | Not applicable | Exploited | Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2023-21036 | Medium | 2023-03-24 | Not applicable | Proof of concept only | In BitmapExport.java, there is a possible failure to truncate images due to a logic error in the code.Product: AndroidVersions: Android kernelAndroid ID: A-264261868References: N/A |
| CVE-2023-20963 | High | 2023-03-24 | Not applicable | Exploited | In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-12 Android-12L Android-13Android ID: A-220302519 |
| CVE-2023-20938 | High | 2023-02-28 | Not applicable | Proof of concept only | In binder_transaction_buffer_release of binder.c, there is a possible use after free due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-257685302References: Upstream kernel |
| CVE-2022-20494 | Medium | 2023-01-26 | Not applicable | Proof of concept only | In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-243794204 |
| CVE-2022-0337 | Medium | 2023-01-02 | Not applicable | Proof of concept only | Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High) |
| CVE-2022-20474 | High | 2022-12-13 | Not applicable | Proof of concept only | In readLazyValue of Parcel.java, there is a possible loading of arbitrary code into the System Settings app due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-240138294 |
| CVE-2022-4262 | High | 2022-12-02 | Not applicable | Exploited | Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2022-20452 | High | 2022-11-08 | Not applicable | Proof of concept only | In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-240138318 |
| CVE-2022-3656 | High | 2022-11-01 | Not applicable | Proof of concept only | Insufficient data validation in File System in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Medium) |
| CVE-2022-3653 | High | 2022-11-01 | Not applicable | Proof of concept only | Heap buffer overflow in Vulkan in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) |
| CVE-2022-20421 | High | 2022-10-11 | Not applicable | Proof of concept only | In binder_inc_ref_for_node of binder.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239630375References: Upstream kernel |
| CVE-2022-20409 | Medium | 2022-10-11 | Not applicable | Proof of concept only | In io_identity_cow of io_uring.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-238177383References: Upstream kernel |
| CVE-2019-5797 | High | 2022-09-29 | Not applicable | Working exploit published | Double free in DOMStorage in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| CVE-2022-20361 | Critical | 2022-08-10 | Not applicable | Proof of concept only | In btif_dm_auth_cmpl_evt of btif_dm.cc, there is a possible vulnerability in Cross-Transport Key Derivation due to Weakness in Bluetooth Standard. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12LAndroid ID: A-231161832 |
| CVE-2022-1364 | High | 2022-07-26 | Not applicable | Exploited | Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| CVE-2022-20120 | Critical | 2022-05-10 | Not applicable | Proof of concept only | Product: AndroidVersions: Android kernelAndroid ID: A-203213034References: N/A |
| CVE-2022-20009 | Medium | 2022-05-10 | Not applicable | Proof of concept only | In various functions of the USB gadget subsystem, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-213172319References: Upstream kernel |
| CVE-2021-39670 | Medium | 2022-05-10 | Not applicable | Proof of concept only | In setStream of WallpaperManager.java, there is a possible way to cause a permanent DoS due to improper input validation. This could lead to local denial of service with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12 Android-12LAndroid ID: A-204087139 |
| CVE-2021-39749 | High | 2022-03-30 | Not applicable | Proof of concept only | In WindowManager, there is a possible way to start non-exported and protected activities due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12LAndroid ID: A-205996115 |
| CVE-2021-39685 | High | 2022-03-16 | Not applicable | Proof of concept only | In various setup methods of the USB gadget subsystem, there is a possible out of bounds write due to an incorrect flag check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-210292376References: Upstream kernel |
| CVE-2021-0928 | High | 2021-12-15 | Not applicable | Proof of concept only | In createFromParcel of OutputConfiguration.java, there is a possible parcel serialization/deserialization mismatch due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-9Android ID: A-188675581 |
| CVE-2021-38003 | High | 2021-11-23 | Not applicable | Exploited | Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| CVE-2021-38001 | High | 2021-11-23 | Not applicable | Proof of concept only | Type confusion in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| CVE-2021-37980 | High | 2021-11-02 | Not applicable | Proof of concept only | Inappropriate implementation in Sandbox in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially bypass site isolation via Windows. |
| CVE-2021-30632 | High | 2021-10-08 | Not applicable | Exploited | Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| CVE-2021-22557 | High | 2021-10-04 | Not applicable | Working exploit published | SLO generator allows for loading of YAML files that if crafted in a specific format can allow for code execution within the context of the SLO Generator. We recommend upgrading SLO Generator past https://github.com/google/slo-generator/pull/173 |
| CVE-2021-30573 | High | 2021-08-03 | Not applicable | Proof of concept only | Use after free in GPU in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| CVE-2021-30563 | High | 2021-08-03 | Not applicable | Exploited | Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| CVE-2021-30551 | High | 2021-06-15 | Not applicable | Exploited | Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| CVE-2021-21220 | High | 2021-04-26 | Not applicable | Exploited | Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| CVE-2021-0326 | High | 2021-02-10 | Not applicable | Proof of concept only | In p2p_copy_client_info of p2p.c, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution if the target device is performing a Wi-Fi Direct search, with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-8.1 Android-9Android ID: A-172937525 |
| CVE-2021-21123 | Medium | 2021-02-09 | Not applicable | Proof of concept only | Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. |
| CVE-2020-16040 | Medium | 2021-01-08 | Not applicable | Exploited | Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
| CVE-2020-16012 | Medium | 2021-01-08 | Not applicable | Proof of concept only | Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
| CVE-2020-0443 | Medium | 2020-11-10 | Not applicable | Proof of concept only | In LocaleList of LocaleList.java, there is a possible forced reboot due to an uncaught exception. This could lead to local denial of service requiring factory reset to restore with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11 Android-8.0 Android-8.1 Android-9 Android-10Android ID: A-152410253 |
| CVE-2020-0423 | High | 2020-10-14 | Not applicable | Proof of concept only | In binder_release_work of binder.c, there is a possible use-after-free due to improper locking. This could lead to local escalation of privilege in the kernel with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-161151868References: N/A |