{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T19:10:46.198Z",
  "tag": {
    "id": "android",
    "label": "Android",
    "isStack": false,
    "url": "https://pwn.watch/t/android",
    "feed": "https://pwn.watch/t/android/feed.xml"
  },
  "counts": {
    "incidents": 15,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 15
  },
  "incidents": [
    {
      "slug": "signal-ringrtc-cve-2026-113380",
      "title": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380",
      "json": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Signal (RingRTC calling library, @signalapp/ringrtc)",
      "tags": [
        "rust",
        "npm",
        "ios",
        "android",
        "signal"
      ],
      "cveIds": [
        "CVE-2026-113380"
      ],
      "affectedVersions": [
        "RingRTC before 2.72.0 (Signal Android, iOS and Desktop clients embedding it)"
      ],
      "fixedVersions": [
        "RingRTC 2.72.0 (update Signal on every device)"
      ],
      "startedAt": "2026-10-20",
      "closedAt": "2026-10-22T18:00:43+02:00",
      "updatedAt": "2026-10-22T18:00:43+02:00",
      "summary": "A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.",
      "xPost": null
    },
    {
      "slug": "google-pixel-cve-2026-58704",
      "title": "Google Pixel: Google Pixel Improper Authorization Vulnerability",
      "url": "https://pwn.watch/i/google-pixel-cve-2026-58704",
      "json": "https://pwn.watch/i/google-pixel-cve-2026-58704.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Google Pixel",
      "tags": [
        "google",
        "cisa-kev",
        "pixel",
        "android"
      ],
      "cveIds": [
        "CVE-2026-58704"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-09-16",
      "closedAt": "2026-09-16",
      "updatedAt": "2026-09-16",
      "summary": "Google Pixel devices contain an improper authorization vulnerability in the cellular modem. A logic error may allow an attacker to bypass permission checks and escalate privileges. Added to CISA KEV on 2026-09-16.",
      "xPost": null
    },
    {
      "slug": "android-framework-cve-2025-48595",
      "title": "Android Framework: Android Framework Integer Overflow Vulnerability",
      "url": "https://pwn.watch/i/android-framework-cve-2025-48595",
      "json": "https://pwn.watch/i/android-framework-cve-2025-48595.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Framework",
      "tags": [
        "android",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-48595"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-06-02",
      "closedAt": "2026-06-02",
      "updatedAt": "2026-06-02",
      "summary": "Android Framework contains an integer overflow vulnerability that allows for code execution that could allow for local privilege escalation. Added to CISA KEV on 2026-06-02.",
      "xPost": null
    },
    {
      "slug": "android-framework-cve-2025-48572",
      "title": "Android Framework: 2 exploited vulnerabilities (CVE-2025-48572, CVE-2025-48633)",
      "url": "https://pwn.watch/i/android-framework-cve-2025-48572",
      "json": "https://pwn.watch/i/android-framework-cve-2025-48572.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Framework",
      "tags": [
        "android",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-48572",
        "CVE-2025-48633"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-12-02",
      "closedAt": "2025-12-02",
      "updatedAt": "2025-12-02",
      "summary": "CVE-2025-48572: Android Framework contains an unspecified vulnerability that allows for privilege escalation. CVE-2025-48633: Android Framework contains an unspecified vulnerability that allows for information disclosure. Added to CISA KEV on 2025-12-02.",
      "xPost": null
    },
    {
      "slug": "android-runtime-cve-2025-48543",
      "title": "Android Runtime: Runtime Use-After-Free Vulnerability",
      "url": "https://pwn.watch/i/android-runtime-cve-2025-48543",
      "json": "https://pwn.watch/i/android-runtime-cve-2025-48543.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Runtime",
      "tags": [
        "android",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2025-48543"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2025-09-04",
      "closedAt": "2025-09-04",
      "updatedAt": "2025-09-04",
      "summary": "Android Runtime contains a use-after-free vulnerability potentially allowing a chrome sandbox escape leading to local privilege escalation. Added to CISA KEV on 2025-09-04.",
      "xPost": null
    },
    {
      "slug": "android-framework-cve-2024-43093",
      "title": "Android Framework Privilege Escalation",
      "url": "https://pwn.watch/i/android-framework-cve-2024-43093",
      "json": "https://pwn.watch/i/android-framework-cve-2024-43093.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Framework",
      "tags": [
        "android",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-43093"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-11-07",
      "closedAt": "2024-11-07",
      "updatedAt": "2024-11-13",
      "summary": "Android Framework contains an unspecified vulnerability that allows for privilege escalation. Added to the CISA KEV catalog on 2024-11-07.",
      "xPost": null
    },
    {
      "slug": "android-pixel-cve-2024-32896",
      "title": "Android Pixel Privilege Escalation",
      "url": "https://pwn.watch/i/android-pixel-cve-2024-32896",
      "json": "https://pwn.watch/i/android-pixel-cve-2024-32896.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Pixel",
      "tags": [
        "android",
        "pixel",
        "google",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-32896"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-06-13",
      "closedAt": "2024-06-13",
      "updatedAt": "2024-06-13",
      "summary": "Android Pixel contains an unspecified vulnerability in the firmware that allows for privilege escalation. Added to the CISA KEV catalog on 2024-06-13.",
      "xPost": null
    },
    {
      "slug": "android-kernel-cve-2024-36971",
      "title": "Android Kernel Remote Code Execution",
      "url": "https://pwn.watch/i/android-kernel-cve-2024-36971",
      "json": "https://pwn.watch/i/android-kernel-cve-2024-36971.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Kernel",
      "tags": [
        "android",
        "cisa-kev",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-36971"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-06-10",
      "closedAt": "2024-08-07",
      "updatedAt": "2024-08-07",
      "summary": "Android contains an unspecified vulnerability in the kernel that allows for remote code execution. This vulnerability resides in Linux Kernel and could impact other products, including but not limited to Android OS. Added to the CISA KEV catalog on 2024-08-07.",
      "xPost": null
    },
    {
      "slug": "android-pixel-cve-2024-29745-29748",
      "title": "Android Pixel: 2 actively exploited vulnerabilities",
      "url": "https://pwn.watch/i/android-pixel-cve-2024-29745-29748",
      "json": "https://pwn.watch/i/android-pixel-cve-2024-29745-29748.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Pixel",
      "tags": [
        "android",
        "pixel",
        "google",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2024-29745",
        "CVE-2024-29748"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-04-04",
      "closedAt": "2024-04-04",
      "updatedAt": "2024-04-05",
      "summary": "CVE-2024-29745: Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices. CVE-2024-29748: Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app. Added to the CISA KEV catalog on 2024-04-04.",
      "xPost": null
    },
    {
      "slug": "android-pixel-cve-2023-21237",
      "title": "Android Pixel Information Disclosure",
      "url": "https://pwn.watch/i/android-pixel-cve-2023-21237",
      "json": "https://pwn.watch/i/android-pixel-cve-2023-21237.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Android Pixel",
      "tags": [
        "android",
        "pixel",
        "google",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-21237"
      ],
      "affectedVersions": [
        "See vendor advisory (versions are not listed in the KEV record)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2024-03-05",
      "closedAt": "2024-03-05",
      "updatedAt": "2024-03-05",
      "summary": "Android Pixel contains a vulnerability in the Framework component, where the UI may be misleading or insufficient, providing a means to hide a foreground service notification. This could enable a local attacker to disclose sensitive information. Added to the CISA KEV catalog on 2024-03-05. CVE-2023-21237 was assigned before 2024; the KEV listing came in 2024.",
      "xPost": null
    },
    {
      "slug": "google-chromium-skia-cve-2023-6345",
      "title": "Google Chromium Skia: Integer Overflow (CVE-2023-6345)",
      "url": "https://pwn.watch/i/google-chromium-skia-cve-2023-6345",
      "json": "https://pwn.watch/i/google-chromium-skia-cve-2023-6345.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Google Chromium Skia",
      "tags": [
        "google",
        "android",
        "chrome",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-6345"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-11-30",
      "closedAt": "2023-11-30",
      "updatedAt": "2023-11-30",
      "summary": "Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a malicious file. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Added to CISA KEV on 2023-11-30.",
      "xPost": null
    },
    {
      "slug": "android-framework-cve-2023-35674",
      "title": "Android Framework: Privilege Escalation (CVE-2023-35674)",
      "url": "https://pwn.watch/i/android-framework-cve-2023-35674",
      "json": "https://pwn.watch/i/android-framework-cve-2023-35674.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Framework",
      "tags": [
        "android",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-35674"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-09-13",
      "closedAt": "2023-09-13",
      "updatedAt": "2023-09-13",
      "summary": "Android Framework contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-09-13.",
      "xPost": null
    },
    {
      "slug": "samsung-mobile-devices-cve-2023-21492",
      "title": "Samsung Mobile Devices: Insertion of Sensitive Information Into Log File (CVE-2023-21492)",
      "url": "https://pwn.watch/i/samsung-mobile-devices-cve-2023-21492",
      "json": "https://pwn.watch/i/samsung-mobile-devices-cve-2023-21492.json",
      "status": "closed",
      "severity": "medium",
      "patchStatus": "patched",
      "product": "Samsung Mobile Devices",
      "tags": [
        "samsung",
        "android",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-21492"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-05-19",
      "closedAt": "2023-05-19",
      "updatedAt": "2023-05-19",
      "summary": "Samsung mobile devices running Android 11, 12, and 13 contain an insertion of sensitive information into log file vulnerability that allows a privileged, local attacker to conduct an address space layout randomization (ASLR) bypass. Added to CISA KEV on 2023-05-19.",
      "xPost": null
    },
    {
      "slug": "google-chromium-skia-cve-2023-2136",
      "title": "Google Chromium Skia: Chrome Skia Integer Overflow (CVE-2023-2136)",
      "url": "https://pwn.watch/i/google-chromium-skia-cve-2023-2136",
      "json": "https://pwn.watch/i/google-chromium-skia-cve-2023-2136.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Google Chromium Skia",
      "tags": [
        "google",
        "android",
        "chrome",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-2136"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-04-21",
      "closedAt": "2023-04-21",
      "updatedAt": "2023-04-21",
      "summary": "Google Chromium Skia contains an integer overflow vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects Google Chrome and ChromeOS, Android, Flutter, and possibly other products. Added to CISA KEV on 2023-04-21.",
      "xPost": null
    },
    {
      "slug": "android-framework-cve-2023-20963",
      "title": "Android Framework: Privilege Escalation (CVE-2023-20963)",
      "url": "https://pwn.watch/i/android-framework-cve-2023-20963",
      "json": "https://pwn.watch/i/android-framework-cve-2023-20963.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "Android Framework",
      "tags": [
        "android",
        "cisa-kev",
        "privilege-escalation"
      ],
      "cveIds": [
        "CVE-2023-20963"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2023-04-13",
      "closedAt": "2023-04-13",
      "updatedAt": "2023-04-13",
      "summary": "Android Framework contains an unspecified vulnerability that allows for privilege escalation after updating an app to a higher Target SDK with no additional execution privileges needed. Added to CISA KEV on 2023-04-13.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "Cybersecurity News Everyday",
      "handle": "TweetThreatNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2043130207125848064/YaxtN2hq_bigger.jpg",
      "text": "CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.",
      "date": "2026-10-21T22:48:16.000Z",
      "url": "https://x.com/TweetThreatNews/status/2113039694753636745",
      "media": [],
      "incident": "signal-ringrtc-cve-2026-113380"
    },
    {
      "authorName": "tsn_hub",
      "handle": "tsnmediahub",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1892172141111496704/d_EnIiZO_bigger.jpg",
      "text": "📵 Update Signal. A critical flaw in its RingRTC calling library could stop a call ending when you hang up, leaving audio and perhaps video running, per its CVE record. RingRTC 2.72.0 fixes it. There's no report of exploitation.\n\nSource: CVE-2026-113380 record",
      "date": "2026-10-21T18:52:01.000Z",
      "url": "https://x.com/tsnmediahub/status/2112980243162026149",
      "media": [],
      "incident": "signal-ringrtc-cve-2026-113380"
    }
  ],
  "changes": [
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis.",
      "body": null,
      "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Closed on pwn.watch: the fix shipped Sep 4 (RingRTC 2.72.0), there is still no known exploitation and no new developments, so this is now a patch-and-move-on item. Make sure Signal is updated on every device.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Researcher Imahian's write-up and conceptual PoC circulate; press coverage begins.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-20",
      "title": "CVE-2026-113380 published by MITRE (CVSS 4.0 9.3); fix is RingRTC 2.72.0.",
      "body": null,
      "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2026-113380",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "google-pixel-cve-2026-58704",
      "incidentTitle": "Google Pixel: Google Pixel Improper Authorization Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-16",
      "title": "CISA added CVE-2026-58704 to the KEV catalog (due 2026-09-19).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/google-pixel-cve-2026-58704"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-04",
      "title": "Signal quietly fixes the bug in RingRTC 2.72.0 (commit \"Ensure calls terminate completely in corner cases\"), about six weeks before disclosure.",
      "body": null,
      "sourceUrl": "https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "android-framework-cve-2025-48595",
      "incidentTitle": "Android Framework: Android Framework Integer Overflow Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-06-02",
      "title": "CISA added CVE-2025-48595 to the KEV catalog (due 2026-06-05).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/android-framework-cve-2025-48595"
    },
    {
      "incident": "android-framework-cve-2025-48572",
      "incidentTitle": "Android Framework: 2 exploited vulnerabilities (CVE-2025-48572, CVE-2025-48633)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-02",
      "title": "CISA added CVE-2025-48572 to the KEV catalog (due 2025-12-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/android-framework-cve-2025-48572"
    },
    {
      "incident": "android-framework-cve-2025-48572",
      "incidentTitle": "Android Framework: 2 exploited vulnerabilities (CVE-2025-48572, CVE-2025-48633)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-12-02",
      "title": "CISA added CVE-2025-48633 to the KEV catalog (due 2025-12-23).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/android-framework-cve-2025-48572"
    },
    {
      "incident": "android-runtime-cve-2025-48543",
      "incidentTitle": "Android Runtime: Runtime Use-After-Free Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-04",
      "title": "CISA added CVE-2025-48543 to the KEV catalog (due 2025-09-25).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/android-runtime-cve-2025-48543"
    },
    {
      "incident": "android-framework-cve-2024-43093",
      "incidentTitle": "Android Framework Privilege Escalation",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-11-07",
      "title": "CISA added CVE-2024-43093 to the KEV catalog (federal deadline 2024-11-28)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/android-framework-cve-2024-43093"
    },
    {
      "incident": "android-kernel-cve-2024-36971",
      "incidentTitle": "Android Kernel Remote Code Execution",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-07",
      "title": "CISA added CVE-2024-36971 to the KEV catalog (federal deadline 2024-08-28)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/android-kernel-cve-2024-36971"
    },
    {
      "incident": "android-pixel-cve-2024-32896",
      "incidentTitle": "Android Pixel Privilege Escalation",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-13",
      "title": "CVE-2024-32896 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-32896",
      "url": "https://pwn.watch/i/android-pixel-cve-2024-32896"
    },
    {
      "incident": "android-pixel-cve-2024-32896",
      "incidentTitle": "Android Pixel Privilege Escalation",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-13",
      "title": "CISA added CVE-2024-32896 to the KEV catalog (federal deadline 2024-07-04)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/android-pixel-cve-2024-32896"
    },
    {
      "incident": "android-kernel-cve-2024-36971",
      "incidentTitle": "Android Kernel Remote Code Execution",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-06-10",
      "title": "CVE-2024-36971 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-36971",
      "url": "https://pwn.watch/i/android-kernel-cve-2024-36971"
    },
    {
      "incident": "android-pixel-cve-2024-29745-29748",
      "incidentTitle": "Android Pixel: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-04",
      "title": "CISA added CVE-2024-29745 to the KEV catalog (federal deadline 2024-04-25)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/android-pixel-cve-2024-29745-29748"
    },
    {
      "incident": "android-pixel-cve-2024-29745-29748",
      "incidentTitle": "Android Pixel: 2 actively exploited vulnerabilities",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-04-04",
      "title": "CISA added CVE-2024-29748 to the KEV catalog (federal deadline 2024-04-25)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/android-pixel-cve-2024-29745-29748"
    },
    {
      "incident": "android-pixel-cve-2023-21237",
      "incidentTitle": "Android Pixel Information Disclosure",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-05",
      "title": "CISA added CVE-2023-21237 to the KEV catalog (federal deadline 2024-03-26)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/android-pixel-cve-2023-21237"
    },
    {
      "incident": "google-chromium-skia-cve-2023-6345",
      "incidentTitle": "Google Chromium Skia: Integer Overflow (CVE-2023-6345)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-11-30",
      "title": "CISA added CVE-2023-6345 to the KEV catalog (due 2023-12-21).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/google-chromium-skia-cve-2023-6345"
    },
    {
      "incident": "android-framework-cve-2023-35674",
      "incidentTitle": "Android Framework: Privilege Escalation (CVE-2023-35674)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-13",
      "title": "CISA added CVE-2023-35674 to the KEV catalog (due 2023-10-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/android-framework-cve-2023-35674"
    },
    {
      "incident": "samsung-mobile-devices-cve-2023-21492",
      "incidentTitle": "Samsung Mobile Devices: Insertion of Sensitive Information Into Log File (CVE-2023-21492)",
      "severity": "medium",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-05-19",
      "title": "CISA added CVE-2023-21492 to the KEV catalog (due 2023-06-09).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/samsung-mobile-devices-cve-2023-21492"
    },
    {
      "incident": "google-chromium-skia-cve-2023-2136",
      "incidentTitle": "Google Chromium Skia: Chrome Skia Integer Overflow (CVE-2023-2136)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-21",
      "title": "CISA added CVE-2023-2136 to the KEV catalog (due 2023-05-12).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/google-chromium-skia-cve-2023-2136"
    },
    {
      "incident": "android-framework-cve-2023-20963",
      "incidentTitle": "Android Framework: Privilege Escalation (CVE-2023-20963)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-04-13",
      "title": "CISA added CVE-2023-20963 to the KEV catalog (due 2023-05-04).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/android-framework-cve-2023-20963"
    }
  ]
}