Accessibility. An authorization issue was addressed with improved state management.

Chromium: CVE-2023-2136 Integer overflow in Skia

Chromium: CVE-2023-6345 Integer overflow in Skia

Chromium: CVE-2024-0519 Out of bounds memory access in V8

Citrix NetScaler ADC and NetScaler Gateway contain a code injection vulnerability that allows for authenticated remote code execution on the management interface with access to NSIP, CLIP, or SNIP.

Chromium: CVE-2023-4762 Type Confusion in V8

Chromium: CVE-2025-5419 Out of bounds read and write in V8

Chromium: CVE-2025-5068 Use after free in Blink

Android Framework contains an unspecified vulnerability that allows for privilege escalation.

Chromium: CVE-2023-4863 Heap buffer overflow in WebP

Chromium: CVE-2023-5217 Heap buffer overflow in vp8 encoding in libvpx

Chromium: CVE-2023-2033 Type Confusion in V8

Chromium: CVE-2023-3079 Type Confusion in V8

Chromium: CVE-2023-7024 Heap buffer overflow in WebRTC

Memory corruption due to unauthorized command execution in GPU micronode while executing specific sequence of commands.

Memory corruption while submitting a large list of sync points in an AUX command to the IOCTLKGSLGPUAUXCOMMAND.

Memory corruption in Graphics Linux while assigning shared virtual memory region during IOCTL call.

Chromium: CVE-2025-2783 Incorrect handle provided in unspecified circumstances in Mojo on Windows

Citrix NetScaler ADC and NetScaler Gateway contain a buffer overflow vulnerability that allows for a denial-of-service when configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) or AAA virtual server.

Information disclosure when an invalid RTCP packet is received during a VoLTE/VoWiFi IMS call.

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value causing it to wrap around and allocate too small of a heap buffer. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This may result in arbitrary code execution. This vulnerability may have been exploited in the wild.

Android Pixel contains a privilege escalation vulnerability that allows an attacker to interrupt a factory reset triggered by a device admin app.

Memory corruption while maintaining memory maps of HLOS memory.

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices

A bogus device can provide a bNumConfigurations value that exceeds the initial value used in usbgetconfiguration for allocating dev->config.

This can lead to out-of-bounds accesses later, e.g. in usbdestroyconfiguration.

Memory corruption in DSP Services during a remote call from HLOS to DSP.

Spreadsheet::ParseExcel contains a remote code execution vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings within the Excel parsing logic.

Memory corruption while rendering graphics using Adreno GPU drivers in Chrome.

Android Framework contains an unspecified vulnerability that allows for privilege escalation.

In the Linux kernel, the following vulnerability has been resolved:

ALSA: usb-audio: Fix out of bounds reads when finding clock sources

The current USB-audio driver code doesn't check bLength of each descriptor at traversing for clock descriptors. That is, when a device provides a bogus descriptor with a shorter bLength, the driver might hit out-of-bounds reads.

For addressing it, this patch adds sanity checks to the validator functions for the clock descriptor traversal. When the descriptor length is shorter than expected, it's skipped in the loop.

For the clock source and clock multiplier descriptors, we can just check bLength against the sizeof() of each descriptor type. OTOH, the clock selector descriptor of UAC2 and UAC3 has an array of bNrInPins elements and two more fields at its tail, hence those have to be checked in addition to the sizeof() check.

Android Pixel contains an information disclosure vulnerability in the fastboot firmware used to support unlocking, flashing, and locking affected devices.