AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

GoogleCVE-2026-0163

Google Android: use after free

Google

CVE-2026-0163 · Published Aug 4, 2026 · updated Sep 23, 2026

Critical9.8
No fix yet
Google advisory

In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected versions

PackageAffectedFixed in
Android
Product
<= Android kernelNo fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from
CISA (its enrichment of the CVE record)
Weakness
CWE-416

More Google advisories

All Google
High 8.3Aug 6Google Chrome: use after freeCVE-2026-19147fixed in 151.0.7922.109Medium 5.3Aug 6Google Chrome: information disclosureCVE-2026-19146fixed in 151.0.7922.109High 7.4Aug 6Google Chrome: privilege escalationCVE-2026-19139fixed in 151.0.7922.109High 8.3Aug 6Google Chrome: buffer overflowCVE-2026-19138fixed in 151.0.7922.109High 8.3Aug 6Google Chrome: use after freeCVE-2026-19137fixed in 151.0.7922.109Medium 6.1Aug 4Google @a2ui/web_core: cross-site scriptingCVE-2026-10032no fix yet