Android flaws being used in attacks
CISA lists 17 flaws in Android products as being used in attacks, most recently on 2 Jun 2026.
AndroidBeing used in attacks
- On CISA’s list
- 17 flaws, added between 3 Nov 2021 and 2 Jun 2026
- Most recent
- CVE-2025-48595, Android Framework Integer Overflow Vulnerability, added 2 Jun 2026
- Used in ransomware
- None known to CISA
- Products
- Framework (6), Pixel (4), Kernel (3), Android Kernel (2), Android OS (1), and 1 more
What to do
- Update every Android product you use.Install the updates Android offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Android Framework
CVE-2025-48595Android Framework Integer Overflow VulnerabilityAndroid Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Android Framework
CVE-2025-48633Android Framework Information Disclosure VulnerabilityAndroid Framework contains an unspecified vulnerability that allows for information disclosure.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Android Framework
CVE-2025-48572Android Framework Privilege Escalation VulnerabilityAndroid Framework contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Android Runtime
CVE-2025-48543Android Runtime Use-After-Free VulnerabilityAndroid Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Android Framework
CVE-2024-43093Android Framework Privilege Escalation VulnerabilityAndroid Framework contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Android Kernel
CVE-2024-36971Android Kernel Remote Code Execution VulnerabilityAndroid contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Android Pixel
CVE-2024-32896Android Pixel Privilege Escalation VulnerabilityAndroid Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Android Pixel
CVE-2024-29748Android Pixel Privilege Escalation VulnerabilityAndroid Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Android Pixel
CVE-2024-29745Android Pixel Information Disclosure VulnerabilityAndroid Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Android Pixel
CVE-2023-21237Android Pixel Information Disclosure VulnerabilityAndroid Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Android Framework
CVE-2023-35674Android Framework Privilege Escalation VulnerabilityAndroid Framework contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Android Framework
CVE-2023-20963Android Framework Privilege Escalation VulnerabilityAndroid Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.CISA’s required actionApply updates per vendor instructions. - Android OS
CVE-2011-1823Android OS Privilege Escalation VulnerabilityThe vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.CISA’s required actionApply updates per vendor instructions. - Android Kernel
CVE-2021-1048Android Kernel Use-After-Free VulnerabilityAndroid kernel contains a use-after-free vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Android Kernel
CVE-2021-0920Android Kernel Race Condition VulnerabilityAndroid kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Android Kernel
CVE-2020-0041Android Kernel Out-of-Bounds Write VulnerabilityAndroid Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu."CISA’s required actionApply updates per vendor instructions. - Android Kernel
CVE-2019-2215Android Kernel Use-After-Free VulnerabilityAndroid Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu."CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Android on CISA’s site.