In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass. This could lead to…

In IntentResolver, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution…

In Core, there is a possible way to forward calls without user knowledge due to a missing permission check. This could lead to local escalation…

In Bluetooth, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System…

In Bluetooth, there is a possible out of bounds read due to a heap buffer overflow. This could lead to remote (proximal/adjacent) information disclosure with…

In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could…

In ContentService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could…

In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This could…

In UsageStatsService, there is a possible way to read installed 3rd party apps due to side channel information disclosure. This could lead to local information…

In Device Policy, there is a possible way to verify if a particular admin app is registered on the device due to side channel information…