In multiple locations, there is a possible way to read files from another user due to a missing permission check. This could lead to local information...
In verifyAndGetBypass of AppOpsService.java, there is a possible method for a malicious app to prevent dialing emergency services under limited circum...
In multiple functions of HeaderPrivacyIconsController.kt, there is a possible way to grand permissions across user due to a logic error in the code. ...
In startAlwaysOnVpn of Vpn.java, there is a possible way to disable always-on VPN due to a logic error in the code. This could lead to local escalatio...
In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could ...
In multiple functions of NotificationManagerService.java, there is a possible way to bypass the per-package channel limits causing resource exhaustion...
In multiple functions of BaseBundle.java, there is a possible way to execute arbitrary code due to a logic error in the code. This could lead to local...
In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error...
In updateNotificationChannelGroupFromPrivilegedListener of NotificationManagerService.java, there is a possible permanent denial of service due to res...
In multiple functions of CertInstaller.java, there is a possible way to install certificates due to a permissions bypass. This could lead to local esc...
In sendCommand of MediaSessionRecord.java, there is a possible way to launch the foreground service while the app is in the background due to FGS whil...
In multiple locations, there is a possible way to launch activities from the background due to a permissions bypass. This could lead to local escalati...
In multiple locations, there is a possible bypass of user profile boundary with a forwarded intent due to improper input validation. This could lead t...
In multiple locations, there is a possible way to bypass the cross profile intent filter due to a logic error in the code. This could lead to local es...
In multiple locations, there is a possible intent filter bypass due to a race condition. This could lead to local escalation of privilege with no addi...