Android — known exploited vulnerabilities
The CISA Known Exploited Vulnerabilities catalog (KEV) lists vulnerabilities that CISA has confirmed are being exploited in the wild; U.S. federal civilian agencies are required to remediate each entry by its due date. This page joins the KEV entries for Android with NVD CVSS scores and CISA's ransomware-campaign flag. See our methodology or browse all CVEs.
Key findings
CISA's Known Exploited Vulnerabilities catalog lists 17 Android vulnerabilities confirmed as exploited in the wild across 6 products; none are currently flagged as used in known ransomware campaigns. Framework is the most-affected product, with 6 entries (35% of the total). CISA added 1 entry in 2026 so far, compared with 3 in 2025. Across the 17 entries with an NVD CVSS score (100% of the total), the average score is 7.4; none is rated critical by NVD. The most recent addition is CVE-2025-48595 (Android Framework Integer Overflow Vulnerability), added on 2026-06-02.
Affected products
| Product | Entries | Share |
|---|---|---|
| Framework | 6 | 35% |
| Pixel | 4 | 24% |
| Kernel | 3 | 18% |
| Android Kernel | 2 | 12% |
| Runtime | 1 | 5.9% |
| Android OS | 1 | 5.9% |
Entries added per year
By date added to the KEV catalog
Exploited Android vulnerabilities (17)
Newest first. CVSS scores from NVD where available.
| CVE | Product | Vulnerability | Date added | Ransomware | CVSS |
|---|---|---|---|---|---|
| CVE-2025-48595 | Framework | Android Framework Integer Overflow Vulnerability | 2026-06-02 | — | HIGH8.4 |
| CVE-2025-48633 | Framework | Android Framework Information Disclosure Vulnerability | 2025-12-02 | — | MEDIUM5.5 |
| CVE-2025-48572 | Framework | Android Framework Privilege Escalation Vulnerability | 2025-12-02 | — | HIGH7.8 |
| CVE-2025-48543 | Runtime | Android Runtime Use-After-Free Vulnerability | 2025-09-04 | — | HIGH8.8 |
| CVE-2024-43093 | Framework | Android Framework Privilege Escalation Vulnerability | 2024-11-07 | — | HIGH7.3 |
| CVE-2024-36971 | Kernel | Android Kernel Remote Code Execution Vulnerability | 2024-08-07 | — | HIGH7.8 |
| CVE-2024-32896 | Pixel | Android Pixel Privilege Escalation Vulnerability | 2024-06-13 | — | HIGH7.8 |
| CVE-2024-29748 | Pixel | Android Pixel Privilege Escalation Vulnerability | 2024-04-04 | — | HIGH7.8 |
| CVE-2024-29745 | Pixel | Android Pixel Information Disclosure Vulnerability | 2024-04-04 | — | MEDIUM5.5 |
| CVE-2023-21237 | Pixel | Android Pixel Information Disclosure Vulnerability | 2024-03-05 | — | MEDIUM5.5 |
| CVE-2023-35674 | Framework | Android Framework Privilege Escalation Vulnerability | 2023-09-13 | — | HIGH7.8 |
| CVE-2023-20963 | Framework | Android Framework Privilege Escalation Vulnerability | 2023-04-13 | — | HIGH7.8 |
| CVE-2011-1823 | Android OS | Android OS Privilege Escalation Vulnerability | 2022-09-08 | — | HIGH7.8 |
| CVE-2021-1048 | Kernel | Android Kernel Use-After-Free Vulnerability | 2022-05-23 | — | HIGH7.8 |
| CVE-2021-0920 | Kernel | Android Kernel Race Condition Vulnerability | 2022-05-23 | — | MEDIUM6.4 |
| CVE-2019-2215 | Android Kernel | Android Kernel Use-After-Free Vulnerability | 2021-11-03 | — | HIGH7.8 |
| CVE-2020-0041 | Android Kernel | Android Kernel Out-of-Bounds Write Vulnerability | 2021-11-03 | — | HIGH7.8 |
Source: CISA Known Exploited Vulnerabilities catalog, joined with NIST NVD CVSS data. Vendor names are normalized across spellings. Compare all vendors.