Android
- Exploited flaws
- 17in 6 products
- Added to CISA's list in 2026
- 13 in 2025
- Used by ransomware
- 0of 17, says CISA
- Disclosure to CISA's list
- 39 daysmedian; 5 of 10 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2011 | 1 |
| 2012 | 0 |
| 2013 | 0 |
| 2014 | 0 |
| 2015 | 0 |
| 2016 | 0 |
| 2017 | 0 |
| 2018 | 0 |
| 2019 | 1 |
| 2020 | 1 |
| 2021 | 2 |
| 2022 | 0 |
| 2023 | 3 |
| 2024 | 5 |
| 2025 | 4 |
| 2026 | 0 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| Framework | 6 | 2023-04-13 | 2026-06-02 |
| Pixel | 4 | 2024-03-05 | 2024-06-13 |
| Kernel | 3 | 2022-05-23 | 2024-08-07 |
| Android Kernel | 2 | 2021-11-03 | 2021-11-03 |
Latest on CISA's list
- Android Framework Integer Overflow Vulnerability
- Android Framework Information Disclosure Vulnerability
- Android Framework Privilege Escalation Vulnerability
- Android Runtime Use-After-Free Vulnerability
- Android Framework Privilege Escalation Vulnerability
- Android Kernel Remote Code Execution Vulnerability
- Android Pixel Privilege Escalation Vulnerability
- Android Pixel Privilege Escalation Vulnerability
- Android Pixel Information Disclosure Vulnerability
- Android Pixel Information Disclosure Vulnerability
In the news
- Google to Allow One-Tap Android App Installs From Approved Third-Party Stores Outside U.S.
- Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
- uCreator Android Spyware Can Steal Telegram 2FA Passwords and Clone WeChat Accounts
- Telegram Android Flaw Lets Attackers Run Code When Users Answer Voice Calls
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.