ZeusQA
Start free

Known exploited vulnerabilities

Android vulnerabilities attackers have used

Every Android vulnerability in CISA's Known Exploited Vulnerabilities catalog, newest first, with the federal due date and whether it fed ransomware campaigns.

The short answer

CISA lists 17 Android vulnerabilities as exploited in the wild, 3 of them added in the last 12 months. The most recent is CVE-2025-48595, added Jun 2, 2026. Framework has the most entries (6).

In KEV, all time
17
Added, last 12 months
3
Used in ransomware
0
New CVEs this week
0

By product

Framework (6), Pixel (4), Kernel (3), Android Kernel (2), Android OS (1), Runtime (1).

Every Android entry in CISA KEV

  1. CVE-2025-48595

    Added · due

    Android Framework Integer Overflow Vulnerability

    Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.

  2. CVE-2025-48633

    Added · due

    Android Framework Information Disclosure Vulnerability

    Android Framework contains an unspecified vulnerability that allows for information disclosure.

  3. CVE-2025-48572

    Added · due

    Android Framework Privilege Escalation Vulnerability

    Android Framework contains an unspecified vulnerability that allows for privilege escalation.

  4. CVE-2025-48543

    Added · due

    Android Runtime Use-After-Free Vulnerability

    Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.

  5. CVE-2024-43093

    Added · due

    Android Framework Privilege Escalation Vulnerability

    Android Framework contains an unspecified vulnerability that allows for privilege escalation.

  6. CVE-2024-36971

    Added · due

    Android Kernel Remote Code Execution Vulnerability

    Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.

  7. CVE-2024-32896

    Added · due

    Android Pixel Privilege Escalation Vulnerability

    Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation.

  8. CVE-2024-29748

    Added · due

    Android Pixel Privilege Escalation Vulnerability

    Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.

  9. CVE-2024-29745

    Added · due

    Android Pixel Information Disclosure Vulnerability

    Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.

  10. CVE-2023-21237

    Added · due

    Android Pixel Information Disclosure Vulnerability

    Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive…

  11. CVE-2023-35674

    Added · due

    Android Framework Privilege Escalation Vulnerability

    Android Framework contains an unspecified vulnerability that allows for privilege escalation.

  12. CVE-2023-20963

    Added · due

    Android Framework Privilege Escalation Vulnerability

    Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.

  13. CVE-2011-1823

    Added · due

    Android OS Privilege Escalation Vulnerability

    The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.

  14. CVE-2021-1048

    Added · due

    Android Kernel Use-After-Free Vulnerability

    Android kernel contains a use-after-free vulnerability that allows for privilege escalation.

  15. CVE-2021-0920

    Added · due

    Android Kernel Race Condition Vulnerability

    Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.

  16. CVE-2020-0041

    Added · due

    Android Kernel Out-of-Bounds Write Vulnerability

    Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and…

  17. CVE-2019-2215

    Added · due

    Android Kernel Use-After-Free Vulnerability

    Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit…

Related

Know the day a CVE lands in your code

Connect a GitHub repository and ZeusQA checks its dependencies daily, briefs each advisory and opens the fix. Three test runs free, no card.

Start freeSee how a run works