GoogleCVE-2026-0163

Google Android: use after free

Critical9.8CVE-2026-0163 · Published Aug 4, 2026 · updated Sep 23, 2026

In multiple functions of vpu_ioctl.c, there is a possible use after free due to a use after free. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

Google advisory

Affected versions

Package	Affected	Fixed in
Android Product	<= Android kernel	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-416

More Google advisories

All Google

Date	Advisory	Severity	Fixed in
Aug 6	Google Chrome: use after free High8.3Aug 6 CVE-2026-19147151.0.7922.109	High8.3	151.0.7922.109
Aug 6	Google Chrome: information disclosure Medium5.3Aug 6 CVE-2026-19146151.0.7922.109	Medium5.3	151.0.7922.109
Aug 6	Google Chrome: privilege escalation High7.4Aug 6 CVE-2026-19139151.0.7922.109	High7.4	151.0.7922.109
Aug 6	Google Chrome: buffer overflow High8.3Aug 6 CVE-2026-19138151.0.7922.109	High8.3	151.0.7922.109
Aug 6	Google Chrome: use after free High8.3Aug 6 CVE-2026-19137151.0.7922.109	High8.3	151.0.7922.109
Aug 4	Google @a2ui/web_core: cross-site scripting Medium6.1Aug 4 CVE-2026-10032No fix yet	Medium6.1	No fix yet

Affected versions

More Google advisories

Critical advisories by email