Cybersecurity News Everyday
@TweetThreatNews
CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.
Android
Security incidents tagged Android. Newest first.
- Incidents
- 15
- Live
- 0
- Patched
- 15
- Days without an incident
- 2
- Longest quiet run: 300 days (Nov 8–Sep 3)
- CriticalPatched
Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.
Signal (RingRTC calling library, @signalapp/ringrtc)Closed Oct 22, 2026
Show 14 older incidents14 older incidents
September 2026 1
HighGoogle Pixel: Google Pixel Improper Authorization VulnerabilityPatched
Google Pixel Patched
Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Added to CISA KEV on 2026-09-16.
Open incident →CVE-2026-58704
June 2026 1
HighAndroid Framework: Android Framework Integer Overflow VulnerabilityPatched
Android Framework Patched
Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation. Added to CISA KEV on 2026-06-02.
Open incident →CVE-2025-48595
December 2025 1
HighAndroid Framework: 2 exploited vulnerabilities (CVE-2025-48572, CVE-2025-48633)Patched
Android Framework Patched
CVE-2025-48572: Android Framework contains an unspecified vulnerability that allows for privilege escalation. CVE-2025-48633: Android Framework contains an unspecified vulnerability that allows for information disclosure. Added to CISA KEV on 2025-12-02.
Open incident →CVE-2025-48572 · CVE-2025-48633
September 2025 1
HighAndroid Runtime: Runtime Use-After-Free VulnerabilityPatched
Android Runtime Patched
Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation. Added to CISA KEV on 2025-09-04.
Open incident →CVE-2025-48543
November 2024 1
HighAndroid Framework Privilege EscalationPatched
Android Framework Patched
Android Framework contains an unspecified vulnerability that allows for privilege escalation. Added to the CISA KEV catalog on 2024-11-07.
Open incident →CVE-2024-43093
June 2024 2
HighAndroid Pixel Privilege EscalationPatched
Android Pixel Patched
Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation. Added to the CISA KEV catalog on 2024-06-13.
Open incident →CVE-2024-32896HighAndroid Kernel Remote Code ExecutionPatched
Android Kernel Patched
Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS. Added to the CISA KEV catalog on 2024-08-07.
Open incident →CVE-2024-36971
April 2024 1
HighAndroid Pixel: 2 actively exploited vulnerabilitiesPatched
Android Pixel Patched
CVE-2024-29745: Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices. CVE-2024-29748: Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app. Added to the CISA KEV catalog on 2024-04-04.
Open incident →CVE-2024-29745 · CVE-2024-29748
March 2024 1
MediumAndroid Pixel Information DisclosurePatched
Android Pixel Patched
Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information. Added to the CISA KEV catalog on 2024-03-05. CVE-2023-21237 was assigned before 2024; the KEV listing came in 2024.
Open incident →CVE-2023-21237
November 2023 1
CriticalGoogle Chromium Skia: Integer Overflow (CVE-2023-6345)Patched
Google Chromium Skia Patched
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Added to CISA KEV on 2023-11-30.
Open incident →CVE-2023-6345
September 2023 1
HighAndroid Framework: Privilege Escalation (CVE-2023-35674)Patched
Android Framework Patched
Android Framework contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-09-13.
Open incident →CVE-2023-35674
May 2023 1
MediumSamsung Mobile Devices: Insertion of Sensitive Information Into Log File (CVE-2023-21492)Patched
Samsung Mobile Devices Patched
Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass. Added to CISA KEV on 2023-05-19.
Open incident →CVE-2023-21492
April 2023 2
CriticalGoogle Chromium Skia: Chrome Skia Integer Overflow (CVE-2023-2136)Patched
Google Chromium Skia Patched
Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Added to CISA KEV on 2023-04-21.
Open incident →CVE-2023-2136HighAndroid Framework: Privilege Escalation (CVE-2023-20963)Patched
Android Framework Patched
Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed. Added to CISA KEV on 2023-04-13.
Open incident →CVE-2023-20963
4 Android incidents in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
Posts 2
- Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
- Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
tsn_hub@tsnmediahub📵 Update Signal. A critical flaw in its RingRTC calling library could stop a call ending when you hang up, leaving audio and perhaps video running, per its CVE record. RingRTC 2.72.0 fixes it. There's no report of exploitation. Source: CVE-2026-113380 record
