Android vulnerabilities in CISA KEV
Android has 17 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 16th highest of any vendor. 3 were added in the last 12 months; none are linked to known ransomware use (0% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 3 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is Framework, with 6 entries. Other frequently affected products: Pixel (4); Kernel (3).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor android --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
17
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2026-06-02
most recent entry
┌─ last 12 months
3
entries added
┌─ ransomware use
0 of 17
0% linked to ransomware
┌─ distinct products
6
affected products
$ awk -F, {print $1} /var/log/kev/android.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 2 | 0 |
| 2022 | 3 | 0 |
| 2023 | 2 | 0 |
| 2024 | 6 | 0 |
| 2025 | 3 | 0 |
| 2026 | 1 | 0 |
$ sort /var/log/kev/android.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- Framework 6 entries
- Pixel 4 entries
- Kernel 3 entries
- Android Kernel 2 entries
- Android OS 1 entry
$ kev-due-dates --vendor android
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ Android
21 days (range 3 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/android.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (12 of 17 have at least one CWE).
$ grep -ril 'Android' /var/log/news | head -5
Our reporting that names Android or one of its KEV CVE ids, newest first.
┌─ /var/log/news
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./android.kev · 17 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2025-48595
Framework
Android Framework Integer Overflow Vulnerability
due 2026-06-05 · CWE-190
$ cat CVE-2025-48595.txt
Description. Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-48572
Framework
Android Framework Privilege Escalation Vulnerability
due 2025-12-23
$ cat CVE-2025-48572.txt
Description. Android Framework contains an unspecified vulnerability that allows for privilege escalation.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-48633
Framework
Android Framework Information Disclosure Vulnerability
due 2025-12-23
$ cat CVE-2025-48633.txt
Description. Android Framework contains an unspecified vulnerability that allows for information disclosure.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-48543
Runtime
Android Runtime Use-After-Free Vulnerability
due 2025-09-25
$ cat CVE-2025-48543.txt
Description. Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2024-43093
Framework
Android Framework Privilege Escalation Vulnerability
due 2024-11-28
$ cat CVE-2024-43093.txt
Description. Android Framework contains an unspecified vulnerability that allows for privilege escalation.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-36971
Kernel
Android Kernel Remote Code Execution Vulnerability
due 2024-08-28 · CWE-416
$ cat CVE-2024-36971.txt
Description. Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-32896
Pixel
Android Pixel Privilege Escalation Vulnerability
due 2024-07-04 · CWE-783
$ cat CVE-2024-32896.txt
Description. Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-29745
Pixel
Android Pixel Information Disclosure Vulnerability
due 2024-04-25 · CWE-908
$ cat CVE-2024-29745.txt
Description. Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2024-29748
Pixel
Android Pixel Privilege Escalation Vulnerability
due 2024-04-25 · CWE-280
$ cat CVE-2024-29748.txt
Description. Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-21237
Pixel
Android Pixel Information Disclosure Vulnerability
due 2024-03-26 · CWE-200
$ cat CVE-2023-21237.txt
Description. Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-35674
Framework
Android Framework Privilege Escalation Vulnerability
due 2023-10-04
$ cat CVE-2023-35674.txt
Description. Android Framework contains an unspecified vulnerability that allows for privilege escalation.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2023-20963
Framework
Android Framework Privilege Escalation Vulnerability
due 2023-05-04 · CWE-295
$ cat CVE-2023-20963.txt
Description. Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed.
Required action. Apply updates per vendor instructions.
- CVE-2011-1823
Android OS
Android OS Privilege Escalation Vulnerability
due 2022-09-29 · CWE-189
$ cat CVE-2011-1823.txt
Description. The vold volume manager daemon in Android kernel trusts messages from a PF_NETLINK socket, which allows an attacker to execute code and gain root privileges. This vulnerability is associated with GingerBreak and Exploit.AndroidOS.Lotoor.
Required action. Apply updates per vendor instructions.
- CVE-2021-0920
Kernel
Android Kernel Race Condition Vulnerability
due 2022-06-13 · CWE-362 CWE-416
$ cat CVE-2021-0920.txt
Description. Android kernel contains a race condition, which allows for a use-after-free vulnerability. Exploitation can allow for privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2021-1048
Kernel
Android Kernel Use-After-Free Vulnerability
due 2022-06-13 · CWE-416
$ cat CVE-2021-1048.txt
Description. Android kernel contains a use-after-free vulnerability that allows for privilege escalation.
Required action. Apply updates per vendor instructions.
- CVE-2019-2215
Android Kernel
Android Kernel Use-After-Free Vulnerability
due 2022-05-03 · CWE-416
$ cat CVE-2019-2215.txt
Description. Android Kernel contains a use-after-free vulnerability in binder.c that allows for privilege escalation from an application to the Linux Kernel. This vulnerability was observed chained with CVE-2020-0041 and CVE-2020-0069 under exploit chain "AbstractEmu."
Required action. Apply updates per vendor instructions.
- CVE-2020-0041
Android Kernel
Android Kernel Out-of-Bounds Write Vulnerability
due 2022-05-03 · CWE-20
$ cat CVE-2020-0041.txt
Description. Android Kernel binder_transaction of binder.c contains an out-of-bounds write vulnerability due to an incorrect bounds check that could allow for local privilege escalation. This vulnerability was observed chained with CVE-2019-2215 and CVE-2020-0069 under exploit chain "AbstractEmu."
Required action. Apply updates per vendor instructions.