# Google Android vulnerabilities Source: https://junglewise.ai/threats/technologies/android Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/android.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 628 vulnerabilities in Google Android: 29 in the last 7 days and 422 in the last 90 days, 49 of them critical and 19 exploited in the wild. The most recent, CVE-2026-95405, was published on 10 November 2026. 119 vulnerabilities in the last four weeks, down 4% on the four before (124). 2 critical against 5, 0 exploited in the wild against 1. ## Counts - Last 7 days: 29 - Last 30 days: 146 - Last 90 days: 422 - All time: 628 (49 critical, 19 exploited in the wild) ## About Google Android Mobile operating system for smartphones and tablets developed by Google. ## Latest Google Android vulnerabilities - [CVE-2026-95405: Google Android Bluetooth buffer overflow in acquireMemory](https://junglewise.ai/threats/cve-2026-95405-in-acquirememory-of-bt-bqr-offload-cc-there-is-a-possible-way-to) (info, published 10 Nov 2026) - [CVE-2026-95400: ST NFC HAL out-of-bounds write in global memory](https://junglewise.ai/threats/cve-2026-95400-in-stnfc-hal-write-of-hal-st21nfc-cc-there-is-a-possible-way-to) (info, published 10 Nov 2026) - [CVE-2026-95397: Android HEVC decoder buffer overflow in sub_layer_hrd_parameters](https://junglewise.ai/threats/cve-2026-95397-in-sub-layer-hrd-parameters-of-hevc-decoder-there-is-a-possible) (info, published 10 Nov 2026) - [CVE-2026-59632: Android framework memory exhaustion in message queue handling](https://junglewise.ai/threats/cve-2026-59632-in-respondreceivedmessage-of-mtsmessagecontroller-cpp-there-is-a) (info, published 10 Nov 2026) - [CVE-2026-59626: Android use-after-free in UssiController connection listener](https://junglewise.ai/threats/cve-2026-59626-in-sendinfo-of-ussicontroller-cpp-there-is-a-possible-way-to) (info, published 10 Nov 2026) - [CVE-2026-59611: Android integer overflow denial of service in framework](https://junglewise.ai/threats/cve-2026-59611-in-multiple-locations-there-is-a-possible-way-to-trigger-a) (info, published 10 Nov 2026) - [CVE-2026-59603: Android MtsMessageController double free in message retry handling](https://junglewise.ai/threats/cve-2026-59603-in-respondreceivedmessage-of-mtsmessagecontroller-cpp-there-is-a) (info, published 10 Nov 2026) - [CVE-2026-59599: Android Pixel hypervisor privilege escalation](https://junglewise.ai/threats/cve-2026-59599-android-on-supported-pixel-devices-before-security-patch-level) (info, published 10 Nov 2026) - [CVE-2026-59597: Android Framework privilege escalation in telephony tunnel management](https://junglewise.ai/threats/cve-2026-59597-in-binddataservice-of-dataservicemanager-java-there-is-a-possible) (info, published 10 Nov 2026) - [CVE-2026-59595: Android SipStack stack exhaustion via unbounded recursion](https://junglewise.ai/threats/cve-2026-59595-in-decodeheadercomponent-of-sipstack-cpp-there-is-a-possible-way) (info, published 10 Nov 2026) - [CVE-2026-59583: Android SIP authentication credentials cleartext disclosure via scheme downgrade](https://junglewise.ai/threats/cve-2026-59583-in-formcredentials-of-sipauhelper-cpp-there-is-a-possible-way-to) (info, published 10 Nov 2026) - [CVE-2026-59582: Android integer overflow in UcePublishManager timer calculation](https://junglewise.ai/threats/cve-2026-59582-in-starttimer-of-ucepublishmanager-cpp-there-is-a-possible-way-to) (info, published 10 Nov 2026) - [CVE-2026-58813: Linux kernel mmap bounds check vulnerability in mman.c](https://junglewise.ai/threats/cve-2026-58813-in-mmap-of-mman-c-there-is-a-possible-way-to-trigger-an-out-of) (info, published 10 Nov 2026) - [CVE-2026-58809: ARM SMMU v3 out-of-bounds write in domain configuration](https://junglewise.ai/threats/cve-2026-58809-in-smmu-domain-config-s1-of-arm-smmu-v3-c-there-is-a-possible-oob) (info, published 10 Nov 2026) - [CVE-2026-58783: Android kernel local denial of service due to logic error](https://junglewise.ai/threats/cve-2026-58783-in-multiple-locations-there-is-a-possible-denial-of-service-due) (info, published 10 Nov 2026) - [CVE-2026-58702: Android TimerAgent permission bypass in createIntent](https://junglewise.ai/threats/cve-2026-58702-in-createintent-of-timeragent-java-there-is-a-possible-permission) (info, published 10 Nov 2026) - [CVE-2026-56980: Android Framework out-of-bounds write in data flow manager](https://junglewise.ai/threats/cve-2026-56980-in-createdataflowasync-of-data-flow-manager-cc-there-is-a) (info, published 10 Nov 2026) - [CVE-2026-56971: Android IMS double free in AudioSession::SendInternalEvent](https://junglewise.ai/threats/cve-2026-56971-in-audiosession-sendinternalevent-of-audiosession-cpp-there-is-a) (info, published 10 Nov 2026) - [CVE-2026-56951: Android Vulkan decoder pointer leak in descriptor set update](https://junglewise.ai/threats/cve-2026-56951-in-on-vkupdatedescriptorsetwithtemplatesized2google-of-vk-decoder) (info, published 10 Nov 2026) - [CVE-2026-56947: Android Framework permission bypass in Telephony PhoneInterfaceManager](https://junglewise.ai/threats/cve-2026-56947-in-getcarrierrestrictionstatus-of-phoneinterfacemanager-java) (info, published 10 Nov 2026) - [CVE-2026-56946: ARM SMMUv3 privilege escalation in arm-smmu-v3 DMA mapping](https://junglewise.ai/threats/cve-2026-56946-in-smmu-unmap-visit-leaf-of-arm-smmu-v3-c-there-is-a-possible-way) (info, published 10 Nov 2026) - [CVE-2026-56935: Android KeyMint deleted key recovery due to logic error](https://junglewise.ai/threats/cve-2026-56935-in-km-os-regen-salt-of-storage-c-there-is-a-possible-way-to) (info, published 10 Nov 2026) - [CVE-2026-56934: Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm) (info, published 10 Nov 2026) - [CVE-2026-56898: Android AES-256-CMAC message authentication code forgery](https://junglewise.ai/threats/cve-2026-56898-in-aes256-cmac-sw-of-aes-rs-there-is-a-possible-way-to-forge) (info, published 10 Nov 2026) - [CVE-2026-55362: Android framework out-of-bounds write in multiple files](https://junglewise.ai/threats/cve-2026-55362-in-multiple-files-there-is-a-possible-out-of-bounds-write-due-to) (info, published 10 Nov 2026) ## Most severe Google Android vulnerabilities - [CVE-2023-6345: Google Skia Integer Overflow Vulnerability](https://junglewise.ai/threats/cve-2023-6345-google-skia-integer-overflow-vulnerability) (critical, exploited in the wild, CVSS 9.6, published 30 Nov 2023) - [CVE-2023-2136: Google Chrome Skia Integer Overflow Vulnerability](https://junglewise.ai/threats/cve-2023-2136-google-chrome-skia-integer-overflow-vulnerability) (critical, exploited in the wild, CVSS 9.6, published 21 Apr 2023) - [CVE-2026-58704: Google Pixel improper authorization in cellular modem](https://junglewise.ai/threats/cve-2026-58704-google-pixel-improper-authorization-in-cellular-modem) (critical, exploited in the wild, CVSS 8.8, published 15 Sep 2026) - [CVE-2026-3909: Google Skia out-of-bounds write in Google Chrome](https://junglewise.ai/threats/cve-2026-3909-google-skia-out-of-bounds-write-in-google-chrome) (critical, exploited in the wild, CVSS 8.8, published 13 Mar 2026) - [CVE-2025-48543: Google Android Runtime use-after-free in system_server](https://junglewise.ai/threats/cve-2025-48543-google-android-runtime-use-after-free-in-system-server) (critical, exploited in the wild, CVSS 8.8, published 4 Sep 2025) - [CVE-2025-48572: Google Android Framework privilege escalation via background activity launch](https://junglewise.ai/threats/cve-2025-48572-google-android-framework-privilege-escalation-via-background) (critical, exploited in the wild, CVSS 7.8, published 8 Dec 2025) - [CVE-2024-36971: Android Kernel Remote Code Execution Vulnerability](https://junglewise.ai/threats/cve-2024-36971-android-kernel-remote-code-execution-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 7 Aug 2024) - [CVE-2023-35674: Android Framework Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2023-35674-android-framework-privilege-escalation-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 13 Sep 2023) - [CVE-2023-20963: Android Framework Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2023-20963-android-framework-privilege-escalation-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 13 Apr 2023) - [CVE-2011-1823: Android OS Privilege Escalation Vulnerability](https://junglewise.ai/threats/cve-2011-1823-android-os-privilege-escalation-vulnerability) (critical, exploited in the wild, CVSS 7.8, published 8 Sep 2022) ## Vulnerabilities per week 119 vulnerabilities in the last four weeks, down 4% on the four before (124). 2 critical against 5, 0 exploited in the wild against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 3 | 1 | 0 | | 24 Aug 2026 | 34 | 4 | 0 | | 31 Aug 2026 | 7 | 4 | 0 | | 7 Sep 2026 | 106 | 8 | 0 | | 14 Sep 2026 | 97 | 5 | 1 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 27 | 0 | 0 | | 12 Oct 2026 | 2 | 2 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 117 | 0 | 0 | | 9 Nov 2026 | 29 | 0 | 0 | ## Other Google technologies - [Google Chrome](https://junglewise.ai/threats/technologies/chrome): 3,930 vulnerabilities - [Google Chrome for iOS](https://junglewise.ai/threats/technologies/chrome-for-ios): 79 vulnerabilities - [Google Pixel](https://junglewise.ai/threats/technologies/google-pixel): 72 vulnerabilities - [Google Cloud Platform](https://junglewise.ai/threats/technologies/google-cloud-platform): 43 vulnerabilities - [Google Chromium V8](https://junglewise.ai/threats/technologies/chromium-v8): 41 vulnerabilities - [Google Chromium](https://junglewise.ai/threats/technologies/chromium): 37 vulnerabilities - [Google TensorFlow](https://junglewise.ai/threats/technologies/tensorflow): 31 vulnerabilities - [Google Pixel Devices](https://junglewise.ai/threats/technologies/pixel-devices): 27 vulnerabilities - [Google Pixel Firmware](https://junglewise.ai/threats/technologies/pixel-firmware): 27 vulnerabilities - [Google Android Framework](https://junglewise.ai/threats/technologies/android-framework): 22 vulnerabilities - [Google Chrome for Android](https://junglewise.ai/threats/technologies/chrome-for-android): 21 vulnerabilities - [Google ChromeOS](https://junglewise.ai/threats/technologies/chromeos): 20 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Google Android vulnerabilities", https://junglewise.ai/threats/technologies/android, 13 November 2026.