ReservedCVE-2026-65076

    Google Android: security vulnerability (CVE-2026-65076)

    Published Sources: BSI

    Share

    What is affected, what to do

    Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen, Denial-of-Service-Zustände zu verursachen oder andere, nicht näher spezifizierte Auswirkungen zu erreichen.

    Update Google Android XR to version 2026-11-01, Google Android Automotive OS to version 2026-11-01, Google Android to version 2026-11-05.

    Affected
    • Google Android = 12..12
    • Google Android = 13..13
    • Google Android XR < *..2026-11-01
    • Google Android Automotive OS < *..2026-11-01
    • Google Android < *..2026-11-05
    • Google Android 14 < *..2026-11-01
    • Google Android 15 < *..2026-11-01
    • Google Android 16 < *..2026-11-01
    • Google Android 17 < *..2026-11-01
    Fixed in
    • Google Android XR 2026-11-01
    • Google Android Automotive OS 2026-11-01
    • Google Android 2026-11-05
    • Google Android 14 2026-11-01
    • Google Android 15 2026-11-01
    • Google Android 16 2026-11-01
    • Google Android 17 2026-11-01

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    —

    Priority

    No value is available for this vulnerability.

    —

    CVSS v3

    No value is available for this vulnerability.

    —

    EPSS score

    No value is available for this vulnerability.

    Show all metrics
    Severity
    Reserved
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    69.01 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    no public PoC known
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    —
    Published

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    High technical severity: assess and remediate the vulnerability in vulnerability handling under Art. 21(2)(e) NIS2 and document the decision.
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    From 11.12.2027, Annex I Part II CRA requires manufacturers of affected products with digital elements to handle vulnerabilities without delay and provide security updates.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    Ein Angreifer kann mehrere Schwachstellen in Google Android ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen, Denial-of-Service-Zustände zu verursachen oder andere, nicht näher spezifizierte Auswirkungen zu erreichen.

    Source: BSI WID Portal, BSI CSAF

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    GoogleAndroid
    • 12
    • < 2026-11-05
    • 13
    • —
    • 2026-11-05
    • —
    GoogleAndroid 14
    • < 2026-11-01
    • 2026-11-01
    GoogleAndroid 15
    • < 2026-11-01
    • 2026-11-01
    GoogleAndroid 16
    • < 2026-11-01
    • 2026-11-01
    GoogleAndroid 17
    • < 2026-11-01
    • 2026-11-01
    GoogleAndroid Automotive OS
    • < 2026-11-01
    • 2026-11-01
    GoogleAndroid XR
    • < 2026-11-01
    • 2026-11-01

    Vendors and products

    Included in the same advisory

    Included in the same advisory
    HighCVE-2026-9040Mali GPU Kernel Driver allows denial of service or disclosure of sensitive information7.7—
    HighCVE-2026-89774Linux Kernel: security vulnerability8.8—
    HighCVE-2026-80604Linux Kernel: Out-of-Bounds Read8.8—
    Not ratedCVE-2026-80336Google Android: security vulnerability——
    HighCVE-2026-80335Out-of-bounds Write in Bootloader8.4—
    HighCVE-2026-79405Improper Input Validation in Modem Firmware7.5—
    CriticalCVE-2026-74912GPU DDK - Fix for CVE-2026-49746 prevents the mapping of graphics buffers > 4GB9.8—
    HighCVE-2026-6726Trusted Computing Group TPM2.0: Incorrect Type Conversion or Cast7.9—
    Not ratedCVE-2026-66114Google Android: security vulnerability——
    Not ratedCVE-2026-66113Google Android: security vulnerability——
    HighCVE-2026-66086Stack-based Buffer Overflow in Modem8.3—
    MediumCVE-2026-65587GPU DDK - OOB write in CalculateNPOTTwiddleSparsePageMap via TEXTURE_BASE_LEVEL change5.5—
    HighCVE-2026-65586Imagination Technologies Graphics DDK: Use After Free7.1—
    HighCVE-2026-64560Linux Kernel: Race Condition7.8—
    MediumCVE-2026-64427Linux Kernel: NULL Pointer Dereference5.5—
    HighCVE-2026-64011Linux Kernel: Use-After-Free7.8—
    MediumCVE-2026-59048Google Android: Out-of-bounds Read5.5—
    MediumCVE-2026-59047Google Android: Improper Input Validation6.2—
    MediumCVE-2026-59046Google Android: Improper Input Validation6.2—
    HighCVE-2026-59045Google Android: Race Condition7.4—
    HighCVE-2026-59044Google Android: Use After Free8.4—
    HighCVE-2026-59043Google Android: Race Condition7.4—
    HighCVE-2026-59042Google Android: Race Condition7.4—
    MediumCVE-2026-59031Google Android: Protection Mechanism Failure6.2—
    Show 200 more CVEs
    Included in the same advisory
    HighCVE-2026-59028Google Android: Confused Deputy8.4—
    MediumCVE-2026-59022Google Android: Incorrect Authorization5.5—
    MediumCVE-2026-59021Google Android: Improper Input Validation6.2—
    MediumCVE-2026-59020Google Android: Race Condition5.9—
    HighCVE-2026-59016Google Android: Path Traversal8.4—
    MediumCVE-2026-59015Google Android: Confused Deputy4.0—
    HighCVE-2026-59014Google Android: Out-of-bounds Write8.4—
    MediumCVE-2026-59012Google Android: Missing Authorization5.5—
    MediumCVE-2026-59011Google Android: Improper Authorization5.5—
    MediumCVE-2026-59010Google Android: Improper Restriction of Operations within the Bounds of a Memory Buffer6.2—
    MediumCVE-2026-59008Google Android: Improper Input Validation6.2—
    MediumCVE-2026-59007Google Android: Out-of-bounds Read5.3—
    MediumCVE-2026-59006Google Android: User Interface (UI) Misrepresentation of Critical Information4.0—
    HighCVE-2026-59005Google Android: Missing Authorization8.4—
    HighCVE-2026-59004Google Android: Uncaught Exception8.4—
    MediumCVE-2026-59003Google Android: Missing Authorization4.0—
    MediumCVE-2026-59002Google Android: Protection Mechanism Failure4.6—
    MediumCVE-2026-59001Google Android: Missing Authorization4.0—
    HighCVE-2026-59000Google Android: Confused Deputy8.4—
    MediumCVE-2026-58997Google Android: Out-of-bounds Read4.0—
    HighCVE-2026-58995Google Android: Heap-based Buffer Overflow8.4—
    HighCVE-2026-58994Google Android: Missing Authorization8.4—
    MediumCVE-2026-58990Google Android: Integer Overflow or Wraparound5.3—
    HighCVE-2026-58989Google Android: Missing Authorization8.4—
    MediumCVE-2026-58988Google Android: Improper Restriction of Operations within the Bounds of a Memory Buffer4.0—
    HighCVE-2026-58986Google Android: Missing Authorization8.4—
    MediumCVE-2026-58985Google Android: Improper Input Validation6.2—
    HighCVE-2026-58984Google Android: Use After Free8.4—
    HighCVE-2026-58979Google Android: Protection Mechanism Failure8.4—
    MediumCVE-2026-58978Google Android: Protection Mechanism Failure6.8—
    MediumCVE-2026-58976Google Android: Exposure of Sensitive Information to an Unauthorized Actor4.0—
    HighCVE-2026-58975Google Android: Improper Restriction of Operations within the Bounds of a Memory Buffer8.4—
    HighCVE-2026-58974Google Android: Improper Privilege Management8.4—
    MediumCVE-2026-58971Google Android: Integer Overflow or Wraparound4.0—
    HighCVE-2026-58970Google Android: Confused Deputy8.4—
    MediumCVE-2026-58969Google Android: Missing Authorization4.0—
    CriticalCVE-2026-58968Google Android: Double Free9.8—
    HighCVE-2026-58966Google Android: Stack-based Buffer Overflow8.4—
    HighCVE-2026-58965Google Android: Confused Deputy8.4—
    HighCVE-2026-58964Google Android: Improper Input Validation8.4—
    HighCVE-2026-58963Google Android: Improper Input Validation7.5—
    HighCVE-2026-58962Google Android: Improper Privilege Management8.4—
    HighCVE-2026-58961Google Android: Protection Mechanism Failure8.4—
    HighCVE-2026-58957Google Android: Confused Deputy8.4—
    HighCVE-2026-58956Google Android: Protection Mechanism Failure8.4—
    MediumCVE-2026-58955Google Android: Improper Input Validation6.2—
    MediumCVE-2026-58953Google Android: Heap-based Buffer Overflow5.3—
    MediumCVE-2026-58951Google Android: Missing Authorization4.0—
    HighCVE-2026-58949Google Android: Stack-based Buffer Overflow7.5—
    HighCVE-2026-58946Google Android: Protection Mechanism Failure8.4—
    MediumCVE-2026-58945Google Android: Observable Discrepancy4.3—
    HighCVE-2026-58944Google Android: Confused Deputy8.4—
    HighCVE-2026-58943Google Android: Confused Deputy8.4—
    HighCVE-2026-58942Google Android: Use After Free8.4—
    HighCVE-2026-58938Google Android: Improper Input Validation7.5—
    MediumCVE-2026-58937Google Android: Improper Input Validation6.2—
    CriticalCVE-2026-58936Google Android: Use After Free9.8—
    HighCVE-2026-58934Google Android: Protection Mechanism Failure8.4—
    MediumCVE-2026-58933Google Android: Out-of-bounds Read5.3—
    HighCVE-2026-58930Google Android: User Interface (UI) Misrepresentation of Critical Information7.8—
    MediumCVE-2026-58927Google Android: Use After Free6.7—
    LowCVE-2026-58926Google Android: Use After Free2.5—
    HighCVE-2026-58925Google Android: Use After Free7.8—
    HighCVE-2026-58924Google Android: Out-of-bounds Read7.5—
    MediumCVE-2026-58915Google Android: Improper Authentication6.1—
    HighCVE-2026-58886Google Android: User Interface (UI) Misrepresentation of Critical Information7.8—
    HighCVE-2026-58885Google Android: Confused Deputy8.4—
    HighCVE-2026-58884Google Android: Confused Deputy8.4—
    HighCVE-2026-58883Google Android: Protection Mechanism Failure7.5—
    HighCVE-2026-58882Google Android: Integer Overflow or Wraparound7.5—
    HighCVE-2026-58879Google Android: Out-of-bounds Write8.4—
    MediumCVE-2026-58877Google Android: Confused Deputy4.0—
    CriticalCVE-2026-58876Google Android: Use After Free9.8—
    MediumCVE-2026-58875Google Android: Improper Input Validation6.2—
    HighCVE-2026-58873Google Android XR: Missing Authorization8.4—
    HighCVE-2026-58871Google Android: Heap-based Buffer Overflow8.4—
    MediumCVE-2026-58870Google Android: Missing Authorization4.0—
    CriticalCVE-2026-58868Google Android: Out-of-bounds Write9.8—
    HighCVE-2026-58867Google Android: Missing Authorization8.4—
    HighCVE-2026-58866Google Android: Missing Authorization8.4—
    HighCVE-2026-58857Google Android: Use After Free8.1—
    HighCVE-2026-58853Google Android: Improper Restriction of Operations within the Bounds of a Memory Buffer7.5—
    HighCVE-2026-58847Google Android: Protection Mechanism Failure8.4—
    HighCVE-2026-58845Google Android: Integer Overflow or Wraparound8.4—
    HighCVE-2026-58844Google Android: Out-of-bounds Read8.4—
    MediumCVE-2026-58838Google Android: Improper Input Validation4.0—
    HighCVE-2026-58837Google Android: Protection Mechanism Failure8.4—
    HighCVE-2026-58836Google Android: Protection Mechanism Failure7.8—
    HighCVE-2026-58829Google Android: Use After Free8.4—
    HighCVE-2026-58828Google Android: Use After Free8.4—
    HighCVE-2026-58827Google Android: Use After Free8.4—
    HighCVE-2026-58826Google Android: Use After Free8.4—
    HighCVE-2026-58825Google Android: Use After Free8.4—
    HighCVE-2026-58824Google Android: Improper Restriction of Operations within the Bounds of a Memory Buffer8.4—
    MediumCVE-2026-58821Google Android: SQL Injection6.2—
    MediumCVE-2026-58817Google Android: Improper Input Validation6.2—
    HighCVE-2026-58814Google Android: Integer Overflow or Wraparound7.5—
    HighCVE-2026-57554Use After Free in DSP Service7.8—
    Not ratedCVE-2026-57549Google Android: security vulnerability——
    Not ratedCVE-2026-57548Google Android: security vulnerability——
    Not ratedCVE-2026-57547Google Android: security vulnerability——
    HighCVE-2026-57546Buffer Over-read in WLAN HAL7.5—
    HighCVE-2026-57545Untrusted Pointer Dereference in Graphics7.8—
    HighCVE-2026-57537Use After Free in DSP Service7.8—
    MediumCVE-2026-55292Google Android: Integer Overflow or Wraparound5.3—
    HighCVE-2026-55289Google Android: Confused Deputy8.4—
    HighCVE-2026-55288Google Android: Uncaught Exception8.4—
    HighCVE-2026-55287Google Android: User Interface (UI) Misrepresentation of Critical Information8.4—
    HighCVE-2026-55283Google Android: Use After Free8.4—
    HighCVE-2026-55275Google Android: Use After Free8.4—
    MediumCVE-2026-55272Google Android: Improper Input Validation6.2—
    HighCVE-2026-55271Google Android: Confused Deputy8.4—
    MediumCVE-2026-55264Google Android: Confused Deputy4.0—
    HighCVE-2026-55263Google Android: User Interface (UI) Misrepresentation of Critical Information8.4—
    HighCVE-2026-55262Google Android: Improper Input Validation8.4—
    HighCVE-2026-55261Google Android: Missing Authorization8.4—
    HighCVE-2026-55257Google Android: User Interface (UI) Misrepresentation of Critical Information8.4—
    HighCVE-2026-53256Linux Kernel: Use After Free8.0—
    MediumCVE-2026-49935Google Android: Path Traversal4.0—
    HighCVE-2026-49934Google Android: Improper Input Validation7.8—
    HighCVE-2026-49931Google Android: Confused Deputy8.4—
    MediumCVE-2026-49924Google Android: Uncontrolled Resource Consumption6.2—
    HighCVE-2026-49923Google Android: User Interface (UI) Misrepresentation of Critical Information8.4—
    HighCVE-2026-49922Google Android: Confused Deputy8.4—
    MediumCVE-2026-49912Google Android: Protection Mechanism Failure4.0—
    HighCVE-2026-49906Google Android: Confused Deputy7.8—
    MediumCVE-2026-49903Google Android: Confused Deputy5.3—
    HighCVE-2026-46242Linux Kernel: Use After Free7.8—
    HighCVE-2026-46232Linux Kernel: security vulnerability8.1—
    Not ratedCVE-2026-45522Google Android: security vulnerability——
    HighCVE-2026-45514Google Android: Protection Mechanism Failure8.4—
    MediumCVE-2026-45204Imagination Technologies Graphics DDK: NULL Pointer Dereference5.5—
    HighCVE-2026-45201Imagination Technologies Graphics DDK: Improper Validation of Specified Quantity in Input7.8—
    HighCVE-2026-45199GPU DDK - rgxfw_to_ptr() does not reject FW private data pointers7.8—
    HighCVE-2026-43499Linux Kernel: Use After Free7.8—
    HighCVE-2026-43284Linux Kernel: Write-what-where Condition8.8—
    MediumCVE-2026-41155GPU DDK - SharedSecMem mapped into all GPU virtual address spaces5.5—
    CriticalCVE-2026-31533Linux Kernel: Use After Free9.8—
    HighCVE-2026-28665Google Android: Improper Input Validation8.4—
    MediumCVE-2026-28645Google Android: Protection Mechanism Failure6.8—
    MediumCVE-2026-28643Google Android: Improper Input Validation6.2—
    MediumCVE-2026-28632Google Android: Protection Mechanism Failure4.0—
    MediumCVE-2026-28621Google Android: Missing Authorization4.0—
    HighCVE-2026-28597Google Android: Improper Input Validation8.4—
    HighCVE-2026-28588Google Android: Improper Access Control8.4—
    LowCVE-2026-28586Google Android: Improper Privilege Management3.3—
    HighCVE-2026-28580Google Android: Classic Buffer Overflow7.8—
    HighCVE-2026-25302Improper Verification of Cryptographic Signature in Boot7.1—
    Not ratedCVE-2026-25301Google Android: security vulnerability——
    HighCVE-2026-25291Use After Free in Graphics7.8—
    Not ratedCVE-2026-25287Google Android: security vulnerability——
    Not ratedCVE-2026-25286Google Android: security vulnerability——
    Not ratedCVE-2026-25285Google Android: security vulnerability——
    CriticalCVE-2026-23240Linux Kernel: Race Condition9.8—
    HighCVE-2026-23184Linux Kernel: Use-After-Free7.8—
    HighCVE-2026-22165Imagination Technologies Graphics DDK: Use After Free8.1—
    MediumCVE-2026-20589MediaTek chipset: Out-of-bounds Write6.7—
    HighCVE-2026-20586MediaTek chipset: Out-of-bounds Write8.8—
    HighCVE-2026-20565MediaTek chipset: Out-of-bounds Write8.4—
    MediumCVE-2026-20564MediaTek chipset: Out-of-bounds Write6.2—
    MediumCVE-2026-20563MediaTek chipset: Out-of-bounds Write5.3—
    MediumCVE-2026-20562MediaTek chipset: Improper Validation of Specified Quantity in Input5.3—
    MediumCVE-2026-20561MediaTek chipset: Out-of-bounds Read5.3—
    MediumCVE-2026-20560MediaTek chipset: Out-of-bounds Read5.3—
    HighCVE-2026-20559MediaTek chipset: Use After Free7.8—
    HighCVE-2026-20558MediaTek chipset: Use After Free8.4—
    HighCVE-2026-20557MediaTek chipset: Out-of-bounds Write7.5—
    HighCVE-2026-20556MediaTek chipset: Out-of-bounds Write7.5—
    MediumCVE-2026-20555MediaTek chipset: Out-of-bounds Read5.3—
    HighCVE-2026-20554MediaTek chipset: Out-of-bounds Write7.1—
    MediumCVE-2026-20553MediaTek chipset: Out-of-bounds Write6.8—
    HighCVE-2026-20549MediaTek chipset: Out-of-bounds Write7.5—
    HighCVE-2026-20548MediaTek chipset: Out-of-bounds Write7.5—
    HighCVE-2026-20547MediaTek chipset: Out-of-bounds Write7.5—
    HighCVE-2026-20546MediaTek chipset: Out-of-bounds Write7.5—
    HighCVE-2026-20545MediaTek chipset: Out-of-bounds Write7.5—
    MediumCVE-2026-20527MediaTek chipset: Improper Validation of Array Index5.3—
    HighCVE-2026-20526MediaTek chipset: Out-of-bounds Write7.1—
    MediumCVE-2026-20525MediaTek chipset: Reachable Assertion5.3—
    HighCVE-2026-20524MediaTek chipset: Improper Validation of Specified Index, Position, or Offset in Input8.4—
    HighCVE-2026-20523MediaTek chipset: Out-of-bounds Write8.4—
    HighCVE-2026-20522MediaTek chipset: Out-of-bounds Write8.4—
    HighCVE-2026-20521MediaTek chipset: Stack-based Buffer Overflow8.4—
    HighCVE-2026-20520MediaTek chipset: Out-of-bounds Write7.5—
    HighCVE-2026-20519MediaTek chipset: Out-of-bounds Write7.5—
    HighCVE-2026-20499MediaTek chipset: Out-of-bounds Write7.5—
    HighCVE-2026-19199GPU DDK - OOB write due to freelist size integer overflow in RGXCreateHWRTDataSet7.1—
    HighCVE-2026-18629Imagination Technologies Graphics DDK: Integer Overflow or Wraparound7.5—
    CriticalCVE-2026-16280GPU DDK - Integer overflow in _PMRLogicalOffsetToPhysicalOffset9.8—
    HighCVE-2026-15466Imagination Technologies Graphics DDK: Use After Free7.0—
    MediumCVE-2026-11891Mali GPU Userspace Driver allows access to already freed memory5.1—
    HighCVE-2026-0053Google Android: Improper Access Control8.4—
    MediumCVE-2025-48600Google Android: Missing Authorization5.5—
    HighCVE-2025-38627Linux Kernel: security vulnerability7.8—
    HighCVE-2025-26433Google Android: User Interface (UI) Misrepresentation of Critical Information8.4—
    HighCVE-2025-22442Google Android: Race Condition7.0—
    HighCVE-2025-22436Google Android: User Interface (UI) Misrepresentation of Critical Information8.4—
    HighCVE-2025-22426Google Android: Improper Access Control7.8—
    HighCVE-2025-22424Google Android: Improper Input Validation7.8—
    HighCVE-2025-0647Arm Neoverse-N2: Sensitive Information in Resource Not Removed Before Reuse7.9—
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2026-65076
    <a href="https://intel.neosec.eu/en/cve/CVE-2026-65076"><img src="https://intel.neosec.eu/badge/cve/CVE-2026-65076.svg?lang=en" alt="CVE-2026-65076 – NEOSEC Intel" height="20"></a>