| Android | Number Of NVD | 6904 | CRITICAL | 484 | HIGH | 3022 | MEDIUM | 3149 | LOW | 241 |
| URL | https://www.android.com/ | ||||||||
|---|---|---|---|---|---|---|---|---|---|
| Explanation | It is an operating system installed on smartphones provided by Google. Since it is open source, many manufacturers use it in their smartphones, tablets, and wearable devices. The support period differs for each development vendor. After Google provides a security patch, it is up to the vendor to provide the patch to the target devices. |
||||||||
| Tag | |||||||||
| No | Type | Name | URL |
|---|---|---|---|
| 1 | https://en.wikipedia.org/wiki/Android_version_history | ||
| 2 | https://source.android.com/setup/start/licenses | ||
| 3 | https://source.android.com/security/bulletin/ | ||
| 4 | https://developer.android.com/ | ||
| 5 | https://developer.android.com/about/versions/ | ||
| 6 | https://android-developers.googleblog.com/ |
| No | Name | Latest Version | Release date | Initial release | Normal Support | Security Support Service Pack Support |
Extended for a fee |
Critical | High | Medium | Low |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | Android 14 | 14.1 | Nov. 6, 2024 | Aug. 7, 2024 | 0 | 3 | 1 | 0 | |||
| 2 | Android 13 | 13.4 | Aug. 7, 2023 | Aug. 15, 2022 | 15 | 317 | 812 | 67 | |||
| 3 | Android 12 | 12.4 | Oct. 17, 2022 | Oct. 4, 2020 | 43 | 479 | 1193 | 106 | |||
| 4 | Android 11 | 11 | Sept. 8, 2020 | Sept. 8, 2020 | 58 | 636 | 1364 | 107 | |||
| 5 | Android 10 | 10 | Sept. 3, 2019 | Sept. 3, 2019 | 103 | 680 | 1055 | 110 | |||
| 6 | Android 9 | 9 | Aug. 6, 2018 | Aug. 6, 2018 | 112 | 463 | 331 | 35 | |||
| 7 | Android 8 | 8.1.0 | Dec. 5, 2017 | Aug. 21, 2017 | 144 | 529 | 318 | 25 | |||
| 8 | Android 7 | 7.1.2 | April 4, 2017 | Aug. 22, 2016 | 116 | 627 | 380 | 20 | |||
| 9 | Android 6 | 6.0.1 | Dec. 7, 2015 | Oct. 5, 2015 | 109 | 734 | 397 | 20 | |||
| 10 | Android 5 | 5.1.1 | April 21, 2015 | Nov. 12, 2014 | 67 | 661 | 317 | 16 | |||
| 11 | Android 4 | 4.4.4 | June 19, 2014 | Oct. 18, 2011 | 53 | 577 | 271 | 16 | |||
| 12 | Android 3 | 3.2.6 | Feb. 1, 2012 | Feb. 22, 2011 | 25 | 420 | 174 | 10 | |||
| 13 | Android 2 | 2.2.3 | Nov. 21, 2011 | Oct. 26, 2009 | 25 | 424 | 181 | 12 | |||
| 14 | Android 1 | 1.6 | Sept. 15, 2009 | Sept. 23, 2008 | 150 | 1594 | 2337 | 209 | |||
| 15 | Android 9.0 | 9.0 | 109 | 441 | 323 | 34 | |||||
| 16 | Android 7.2 | 7.2 | 16 | 61 | 79 | 9 | |||||
| 17 | Android 12.1 | 12.1 | 15 | 229 | 224 | 23 | |||||
| 18 | Android 12.0l | 12.0l | 0 | 28 | 68 | 9 | |||||
| 19 | Android 12.0 | 12.0 | 43 | 447 | 1159 | 104 | |||||
| 20 | Android 11.0 | 11.0 | 58 | 636 | 1364 | 107 | |||||
| 21 | Android 10.0 | 10.0 | 103 | 680 | 1055 | 110 |
| No | CVSS3 CVSS2 |
Level Attach Vector |
Title | CWE | CVE | cpe23Uri | or higher | or less | more than | less than | Update date Published date |
Show Affected | Exploit PoC Search |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 |
3.3 - |
LOW
Local |
In multiple functions of AppOpsService.java, there is a possible missing permission check due to a permissions bypass. This could lead to local information disclosure with no additional execution pri… |
CWE-269
Improper Privilege Management |
CVE-2026-28586 |
cpe:2.3:o:google:android:16.0:qpr2_beta_3 cpe:2.3:o:google:android:16.0:qpr2_beta_2 cpe:2.3:o:google:android:16.0… |
2026-06-3 22:26 2026-06-2 |
Show | GitHub Exploit DB Packet Storm | ||||
| 2 |
4.0 - |
MEDIUM
Local |
In fixInitiatingUserIfNecessary of CallIntentProcessor.java, there is a possible way to make an emergency call due to a logic error in the code. This could lead to local with null execution privileg… |
CWE-476
NULL Pointer Dereference |
CVE-2026-28581 |
cpe:2.3:o:google:android:16.0:qpr2_beta_3 cpe:2.3:o:google:android:16.0:qpr2_beta_2 cpe:2.3:o:google:android:16.0… |
2026-06-3 22:29 2026-06-2 |
Show | GitHub Exploit DB Packet Storm | ||||
| 3 |
7.8 - |
HIGH
Local |
In multiple functions, there is a possible desync in persistence due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. Use… |
CWE-120
Classic Buffer Overflow |
CVE-2026-28580 |
cpe:2.3:o:google:android:16.0:qpr2_beta_3 cpe:2.3:o:google:android:16.0:qpr2_beta_2 cpe:2.3:o:google:android:16.0… |
2026-06-3 22:35 2026-06-2 |
Show | GitHub Exploit DB Packet Storm | ||||
| 4 |
5.5 - |
MEDIUM
Local |
In multiple functions of DevicePolicyManagerService.java, there is a possible desync from persistence due to improper input validation. This could lead to local denial of service with no additional e… |
CWE-20
Improper Input Validation |
CVE-2026-28578 |
cpe:2.3:o:google:android:16.0:qpr2_beta_3 cpe:2.3:o:google:android:16.0:qpr2_beta_2 cpe:2.3:o:google:android:16.0… |
2026-06-3 22:35 2026-06-2 |
Show | GitHub Exploit DB Packet Storm | ||||
| 5 |
7.8 - |
HIGH
Local |
In addWindow of WindowManagerService.java, there is a possible tapjacking issue due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privi… |
CWE-1021
Improper Restriction of Rendered UI Layers or Frames |
CVE-2026-28577 |
cpe:2.3:o:google:android:16.0:qpr2_beta_3 cpe:2.3:o:google:android:16.0:qpr2_beta_2 cpe:2.3:o:google:android:16.0… |
2026-06-3 22:47 2026-06-2 |
Show | GitHub Exploit DB Packet Storm | ||||
| 6 |
7.8 - |
HIGH
Local |
In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User… |
CWE-122
Heap-based Buffer Overflow |
CVE-2026-0100 |
cpe:2.3:o:google:android:16.0:qpr2_beta_3 cpe:2.3:o:google:android:16.0:qpr2_beta_2 cpe:2.3:o:google:android:16.0… |
2026-06-3 22:39 2026-06-2 |
Show | GitHub Exploit DB Packet Storm | ||||
| 7 |
7.8 - |
HIGH
Local |
In onNullBinding of HostEmulationManager.java, there is a possible way to launch an activity from the background due to a logic error in the code. This could lead to local escalation of privilege wit… |
CWE-273
Improper Check for Dropped Privileges |
CVE-2026-0099 |
cpe:2.3:o:google:android:16.0:qpr2_beta_3 cpe:2.3:o:google:android:16.0:qpr2_beta_2 cpe:2.3:o:google:android:16.0… |
2026-06-3 22:40 2026-06-2 |
Show | GitHub Exploit DB Packet Storm | ||||
| 8 |
7.8 - |
HIGH
Local |
In getCallingPackageName of Shared.java, there is a possible way to bypass activity start restrictions due to a confused deputy. This could lead to local escalation of privilege with no additional ex… |
CWE-441
Confused Deputy |
CVE-2026-0098 |
cpe:2.3:o:google:android:16.0:qpr2_beta_3 cpe:2.3:o:google:android:16.0:qpr2_beta_2 cpe:2.3:o:google:android:16.0… |
2026-06-3 22:40 2026-06-2 |
Show | GitHub Exploit DB Packet Storm | ||||
| 9 |
8.0 - |
HIGH
Adjacent |
In multiple locations, there is a possible way to bypass user interaction when pairing an LE device due to a logic error. This could lead to remote (proximal/adjacent) escalation of privilege with no… |
CWE-693
Protection Mechanism Failure |
CVE-2026-0097 |
cpe:2.3:o:google:android:16.0:qpr2_beta_3 cpe:2.3:o:google:android:16.0:qpr2_beta_2 cpe:2.3:o:google:android:16.0… |
2026-06-3 22:41 2026-06-2 |
Show | GitHub Exploit DB Packet Storm | ||||
| 10 |
7.8 - |
HIGH
Local |
In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to misleading or insufficient UI. This could lead to local escalation of privilege w… |
CWE-451
User Interface (UI) Misrepresentation of Critical Information |
CVE-2026-0096 |
cpe:2.3:o:google:android:16.0:qpr2_beta_3 cpe:2.3:o:google:android:16.0:qpr2_beta_2 cpe:2.3:o:google:android:16.0… |
2026-06-3 22:41 2026-06-2 |
Show | GitHub Exploit DB Packet Storm |