CVE-2026-55269
Google Android: improper input validation
- Risk score
- 47/100
- CVSS
- 7.8 v3.1
- Exploit chance (30 days)
- 0.1%
- Published
- 5 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- Affected
- Google Android
- Fix
- Apply the vendor's security update; see the linked advisory.
- Exploitation
- No known exploitation
Story map
At a glance
Google Android: Yellow, plan it in. In cfg2prop of btif_storage.cc, there is a possible out-of-bounds write due to a heap buffer overflow. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.
The flaws
- CVE-2026-55269: Improper input validation (CVSS 7.8 · EPSS 0%)
- CVE-2026-58835: Heap buffer overflow can lead to remote code execution (CVSS 8.8 · EPSS 0%)
- CVE-2026-55280: In multiple locations, there is a possible out-of-bounds write due to uninitialized data (CVSS 8.8 · EPSS 0%)
- CVE-2026-45524: Missing authorisation (CVSS 8.8 · EPSS 0%)
The fix
Fix: Apply the vendor's security update; see the linked advisory.
Who is exposed: Google Android
Where it stands
- No known exploitation
Connects to
- Same weakness: Heap buffer overflow (CWE-122). 400 other warnings in 30 days
- Same product: Earlier Google Android warnings. 23 in the last 90 days
Why it is Yellow
- CVSS 7.8 high
References
Original description
In FilterCapturedPacket of snoop_logger.cc, there is a possible memory safety issue due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Last activity 5 Oct 2026. Patch Forecast updates every hour.