Security
Security writeups
Vulnerability reports submitted to vendor disclosure programmes, published once their embargo has run. Each writeup sets out what was reported, the mechanism behind it, and how the vendor assessed it.
- Published
- 5
- Programme
- 1
- Since
- 2026
GameManagerService: two unguarded Binder methods leak cross-profile game activity to any app
GameManagerService exposes two Binder methods with no permission check and no caller validation. An app holding zero declared permissions can register a listener that receives real-time game-activity callbacks for every user on the device…
Android & Google Devices VRPID 491427633Reported 2026-03-10MediaSessionService: any app can name a class and have system_server construct it
MediaSessionService exposes two Binder methods that take a class name as a string and instantiate it inside system_server:
Android & Google Devices VRPID 492815504Reported 2026-03-15Unbounded notification bitmap offload to /data/system — storage-exhaustion DoS on Android 14–16
Android's notification bitmap offload path writes caller-supplied image data into the privileged /data/system partition. It applies no server-side bound on bitmap dimensions or byte size, no per-package quota and no total quota, and the…
Android & Google Devices VRPID 476317300Reported 2026-01-16Background activity launch from a zero-permission app: six system components that fire an attacker's PendingIntent with their own BAL exemption
Android 15 tightened background activity launch with a dual opt-in: both the creator of a PendingIntent and the sender must agree before the launch is allowed from the background. The intent was to make BAL something two parties consent to…
Android & Google Devices VRPID 492470616Reported 2026-03-13TrustManagerService.isActiveUnlockRunning: the one Binder method in ITrustManager with no caller check
ITrustManager exposes sixteen Binder methods. Fifteen of them enforce something — a signature-level permission, an @EnforcePermission annotation, or a cross-user boundary check through ActivityManager.handleIncomingUser(). One does not.
Android & Google Devices VRPID 491430113Reported 2026-03-10
Findings still under coordinated disclosure are deliberately absent from this page. A report appears here only once the vendor has had the chance to respond and the embargo has ended.