pwned.coffeeUpdated 3 min ago

The menu

Android

Major outage

1 live incident affecting Android, 1 critical, 1 not fully patched.

Today's specials

  1. criticalpartial fix Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path @capacitor/android (npm), @capacitor/ios (npm), github.com/ionic-team/capacitor-swift-pm (swift), com.capacitorjs:core (maven) ### Impact Capacitor's WebView navigation guard validated only the **host and scheme** of a target URL, not its **path**. Because the internal HTTP proxy path (`/_capacitor_http_interceptor_`) is served at the application's own origin, a frame navigation to it was always treated as in-app navigation and allowed. Loading that path as a document caused the… fixed in @capacitor/android 6.2.2 +15CVE-2026-1039225 sources

5 spills in 12 months for Android

Each square is a day. Tap one to see what spilled. Heat = critical 4, high 3, medium 2, low 1, update half.

Past orders

  1. highpatchedexploited Google Pixel Improper Authorization Vulnerability Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Added to CISA KEV on 2026-09-16 (federal deadline 2026-09-19). CVE-2026-587042 sources
  2. highpatchedexploited Android Framework Integer Overflow Vulnerability Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation. Added to CISA KEV on 2026-06-02 (federal deadline 2026-06-05). CVE-2025-485952 sources
  3. highpatchedexploited Google Skia Out-of-Bounds Write Vulnerability Google Skia contains an out-of-bounds write vulnerability that could allow a remote attacker to perform out of bounds memory access via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Added to CISA KEV on 2026-03-13 (federal deadline 2026-03-27). CVE-2026-39091 source
  4. highpatchedexploited Android Framework Information Disclosure Vulnerability Android Framework contains an unspecified vulnerability that allows for information disclosure. Can be chained with CVE-2025-48572. Added to CISA KEV on 2025-12-02 (federal deadline 2025-12-23). CVE-2025-48572CVE-2025-486333 sources

More in Devices & apps

Follow Android

RSS: /feed.xml?stack=android. JSON: /incidents.json?stack=android. Or add it to your usual for delivery.