GoogleCVE-2026-58731

Google Android: out-of-bounds read

Medium6.2CVE-2026-58731 · Published Sep 15, 2026 · updated Sep 18, 2026

In multiple functions of physmem_extmem_linux.c, there is a possible out-of-bounds read due to uninitialized data. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

Google advisory

Affected versions

Package	Affected	Fixed in
Android Product	<= Android kernel	No fix yet

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Severity from: CISA (its enrichment of the CVE record)
Weakness: CWE-125, CWE-457

More Google advisories

All Google

Date	Advisory	Severity	Fixed in
Sep 15	Google Chrome: race condition High8.3Sep 15 CVE-2026-91743153.0.8010.47	High8.3	153.0.8010.47
Sep 15	Google Chrome: race condition Medium5.3Sep 15 CVE-2026-91744153.0.8010.47	Medium5.3	153.0.8010.47
Sep 15	Google Chrome: use after free High8.8Sep 15 CVE-2026-91745153.0.8010.47	High8.8	153.0.8010.47
Sep 15	Google Chrome: integer overflow Medium4.3Sep 15 CVE-2026-91746153.0.8010.47	Medium4.3	153.0.8010.47
Sep 15	Google Chrome: use after free Low3.1Sep 15 CVE-2026-91747153.0.8010.47	Low3.1	153.0.8010.47
Sep 15	Google Chrome: race condition High8.3Sep 15 CVE-2026-91748153.0.8010.47	High8.3	153.0.8010.47

Affected versions

More Google advisories

Critical advisories by email