Android vulnerabilities
- Android has 12 CVE records published between 28 Oct 2023 and 28 Oct 2026, ranking #271 of 420 vendors on this site by that count.
- Of the 12 with a CVSS score, 9 (75%) are rated critical or high; 0 (0% of all) have no CVSS score.
- 17 vulnerabilities attributed to Android are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog; the most recent, CVE-2025-48595, was added on 2 Jun 2026.
- None of them is marked as known to be used in ransomware campaigns.
- For the 17 KEV entries with a published CVE record, the median time from CVE publication to KEV listing is 2 days.
Records are attributed to Android from the vendor named in the source records. About the data.
CVE records per year
Show data as a table
| Year | CVE records |
|---|---|
| 2017 | 1 |
| 2018 | 0 |
| 2019 | 54 |
| 2020 | 1 |
| 2021 | 2 |
| 2022 | 0 |
| 2023 | 4 |
| 2024 | 6 |
| 2025 | 4 |
| 2026 | 2 |
2026 is partial (through 28 Oct 2026), shown in a lighter bar.
| Year | Records | Critical | High | Critical or high | Not scored |
|---|---|---|---|---|---|
| 2026 | 2 | 1 | 1 | 100% | 0% |
| 2025 | 4 | 0 | 2 | 50% | 0% |
| 2024 | 6 | 0 | 5 | 83.3% | 0% |
| 2023 | 4 | 0 | 2 | 66.7% | 25% |
| 2022 | 0 | 0 | 0 | — | — |
| 2021 | 2 | 0 | 1 | 50% | 0% |
| 2020 | 1 | 0 | 1 | 100% | 0% |
| 2019 | 54 | 0 | 1 | 100% | 98.1% |
| 2018 | 0 | 0 | 0 | — | — |
| 2017 | 1 | 0 | 0 | — | 100% |
| Before 2017 | 1 | ||||
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026. About the data.
Exploited vulnerabilities in CISA's KEV catalog
| CVE | Product | Name | Added | Ransomware |
|---|---|---|---|---|
| CVE-2025-48595 | Framework | Android Framework Integer Overflow Vulnerability | 2026-06-02 | Unknown |
| CVE-2025-48572 | Framework | Android Framework Privilege Escalation Vulnerability | 2025-12-02 | Unknown |
| CVE-2025-48633 | Framework | Android Framework Information Disclosure Vulnerability | 2025-12-02 | Unknown |
| CVE-2025-48543 | Runtime | Android Runtime Use-After-Free Vulnerability | 2025-09-04 | Unknown |
| CVE-2024-43093 | Framework | Android Framework Privilege Escalation Vulnerability | 2024-11-07 | Unknown |
| CVE-2024-36971 | Kernel | Android Kernel Remote Code Execution Vulnerability | 2024-08-07 | Unknown |
| CVE-2024-32896 | Pixel | Android Pixel Privilege Escalation Vulnerability | 2024-06-13 | Unknown |
| CVE-2024-29745 | Pixel | Android Pixel Information Disclosure Vulnerability | 2024-04-04 | Unknown |
| CVE-2024-29748 | Pixel | Android Pixel Privilege Escalation Vulnerability | 2024-04-04 | Unknown |
| CVE-2023-21237 | Pixel | Android Pixel Information Disclosure Vulnerability | 2024-03-05 | Unknown |
| CVE-2023-35674 | Framework | Android Framework Privilege Escalation Vulnerability | 2023-09-13 | Unknown |
| CVE-2023-20963 | Framework | Android Framework Privilege Escalation Vulnerability | 2023-04-13 | Unknown |
| CVE-2011-1823 | Android OS | Android OS Privilege Escalation Vulnerability | 2022-09-08 | Unknown |
| CVE-2021-0920 | Kernel | Android Kernel Race Condition Vulnerability | 2022-05-23 | Unknown |
| CVE-2021-1048 | Kernel | Android Kernel Use-After-Free Vulnerability | 2022-05-23 | Unknown |
| CVE-2019-2215 | Android Kernel | Android Kernel Use-After-Free Vulnerability | 2021-11-03 | Unknown |
| CVE-2020-0041 | Android Kernel | Android Kernel Out-of-Bounds Write Vulnerability | 2021-11-03 | Unknown |
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.
Highest exploit-prediction scores (EPSS)
EPSS estimates the probability that a vulnerability is exploited in the next 30 days. These are the 10 highest-scoring Android records today.
| CVE | EPSS | Percentile | Severity | In KEV |
|---|---|---|---|---|
| CVE-2019-2215 | 72.1% | 99.4% | High | Yes |
| CVE-2011-1823 | 41.4% | 98.7% | High | Yes |
| CVE-2020-0041 | 3.2% | 88.3% | High | Yes |
| CVE-2024-32896 | 3% | 87.3% | High | Yes |
| CVE-2024-36971 | 2.7% | 85.9% | High | Yes |
| CVE-2023-35674 | 2.6% | 85.5% | High | Yes |
| CVE-2018-9583 | 2.3% | 82.9% | Not scored | No |
| CVE-2019-1991 | 2% | 80.9% | Not scored | No |
| CVE-2025-48595 | 1.9% | 80.1% | High | Yes |
| CVE-2019-1988 | 1.9% | 79.7% | Not scored | No |
Source: FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of 28 Oct 2026; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of 28 Oct 2026; CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.27, as of 27 Oct 2026. About the data.