Android
Vendor:
First CVE: May 26, 2009 · Active for 17 years
9,257
Total CVEs
More Total CVEs than 100% of tracked products
514.3
Avg CVEs / Year
Higher CVE frequency than 100% of tracked products
7.0
Avg CVSS
Higher Avg CVSS than 41% of tracked products
0.4%
KEV Rate
Higher KEV Rate than 96% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Android over time
Volume of CVEsAvg CVSS Base Score
First CVE
May 26, 2009
17 years ago
Most Recent CVE
Jul 14, 2026
10 days ago
CVE Severity & Scoring
Android9,257 CVEs
43%
47%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local6,044 (65.3%)
Network2,249 (24.3%)
Unknown597 (6.4%)
Physical163 (1.8%)
Adjacent Network204 (2.2%)
Attack Complexity
Low8,175 (88.3%)
High485 (5.2%)
Unknown597 (6.4%)
User Interaction
None6,425 (69.4%)
Unknown597 (6.4%)
Required2,235 (24.1%)
Privileges Required
Low3,428 (37.0%)
High1,312 (14.2%)
None3,920 (42.3%)
Unknown597 (6.4%)
Top CVEs
Signals from CVEs in this product scope (9257 CVEs).
9,257 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2011-0611HIGH Adobe Flash Player before 10.2.154.27 on Windows, Mac OS X, Linux, and Solaris and 10.2.156.12 and earlier on Android; Adobe AIR before 2.6.19140; and Authplay.dll (aka AuthPlayLib | Apr 13, 2011 | 8.8 | 98 | YES | YES |
CVE-2012-0754HIGH Adobe Flash Player before 10.3.183.15 and 11.x before 11.1.102.62 on Windows, Mac OS X, Linux, and Solaris; before 11.1.111.6 on Android 2.x and 3.x; and before 11.1.115.6 on Andro | Feb 16, 2012 | 8.1 | 97 | YES | YES |
CVE-2019-2215HIGH A use-after-free in binder.c allows an elevation of privilege from an application to the Linux Kernel. No user interaction is required to exploit this vulnerability, however exploi | Oct 11, 2019 | 7.8 | 96 | YES | YES |
CVE-2011-0609HIGH Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android; Adobe AIR 2.5.1 and earlier; a | Mar 15, 2011 | 7.8 | 95 | YES | YES |
CVE-2016-0984HIGH Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 on Linux, Adobe AIR before 20.0 | Feb 10, 2016 | 8.8 | 92 | YES | YES |
CVE-2015-8651HIGH Integer overflow in Adobe Flash Player before 18.0.0.324 and 19.x and 20.x before 20.0.0.267 on Windows and OS X and before 11.2.202.559 on Linux, Adobe AIR before 20.0.0.233, Adob | Dec 28, 2015 | 8.8 | 92 | YES | NO |
CVE-2014-0569HIGH Integer overflow in Adobe Flash Player before 13.0.0.250 and 14.x and 15.x before 15.0.0.189 on Windows and OS X and before 11.2.202.411 on Linux, Adobe AIR before 15.0.0.293, Adob | Oct 15, 2014 | 9.3 | 91 | NO | YES |
CVE-2011-2140HIGH Adobe Flash Player before 10.3.183.5 on Windows, Mac OS X, Linux, and Solaris and before 10.3.186.3 on Android, and Adobe AIR before 2.7.1 on Windows and Mac OS X and before 2.7.1. | Aug 10, 2011 | 10.0 | 90 | NO | YES |
CVE-2015-1538HIGH Integer overflow in the SampleTable::setSampleToChunkParams function in SampleTable.cpp in libstagefright in Android before 5.1.1 LMY48I allows remote attackers to execute arbitrar | Oct 1, 2015 | 10.0 | 89 | NO | YES |
CVE-2015-3105HIGH Adobe Flash Player before 13.0.0.292 and 14.x through 18.x before 18.0.0.160 on Windows and OS X and before 11.2.202.466 on Linux, Adobe AIR before 18.0.0.144 on Windows and before | Jun 10, 2015 | 10.0 | 89 | NO | YES |
Exploit Exposure
Signals from CVEs in this product scope (9257 CVEs).
CISA KEV
36 CVEs
0.4% of CVEs· 96th percentile
Metasploit
18 CVEs
0.2% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
116 CVEs
1.3% of CVEs· 87th percentile
Social Chatter
Signals from CVEs in this product scope (9257 CVEs).
Media Mentions
Signals from CVEs in this product scope (9257 CVEs).
Top CNAs Publishing CVEs For Android
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 9.0 | 807 | 7.3 | 0.5% | 1 | 3 |
| 8.1 | 799 | 7.4 | 0.7% | 0 | 11 |
| 8.0 | 758 | 7.5 | 0.8% | 0 | 15 |
| 7.2 | 25 | 8.4 | 0.5% | 0 | 0 |
| 7.1.2 | 611 | 7.4 | 1.0% | 0 | 10 |
| 7.1.1 | 673 | 7.3 | 1.0% | 0 | 12 |
| 7.1.0 | 304 | 7.1 | 0.8% | 0 | 4 |
| 7.1 | 24 | 8.0 | 0.3% | 0 | 0 |
| 7.0 | 787 | 7.3 | 0.9% | 0 | 16 |
| 6.0.1 | 628 | 7.2 | 1.3% | 0 | 19 |
| 6.0 | 721 | 7.2 | 1.2% | 0 | 20 |
| 5.1.1 | 250 | 7.2 | 1.7% | 0 | 12 |
| 5.1.0 | 268 | 7.2 | 1.7% | 0 | 11 |
| 5.1 | 320 | 7.2 | 1.5% | 0 | 11 |
| 5.0.2 | 189 | 7.0 | 1.5% | 0 | 5 |
| 5.0.1 | 281 | 7.2 | 1.7% | 0 | 11 |
| 5.0 | 327 | 7.2 | 1.6% | 0 | 13 |
| 4.4.4 | 119 | 6.9 | 2.2% | 0 | 5 |
| 4.4.3 | 202 | 7.2 | 2.2% | 0 | 10 |
| 4.4.2 | 202 | 7.2 | 2.2% | 0 | 10 |