Android & Mobile Components
MediaTek November Bulletin Covers Modem and Chipset VulnerabilitiesNew!!
MediaTek lists modem and chipset flaws in its November bulletin. Map device firmware to affected chipsets, obtain OEM fixes, and retain update evidence.
ZTE Z80 Ultra Build B28MR2 Fixes Five Information-Disclosure Flaws
ZTE fixes five Z80 Ultra information-disclosure flaws in B28MR2. Match NX741J devices, obtain the supported build, validate it, and retain evidence.
MediaTek October 2026 Bulletin Fixes 31 Chipset Vulnerabilities
MediaTek's October 2026 bulletin fixes 31 chipset flaws. Map devices to affected chipsets, obtain OEM updates, validate, and retain evidence.
ZTE SmartLife 2.8.4 Addresses Four Account-Security Vulnerabilities
ZTE SmartLife fixes cover registration email ownership, password reset, account enumeration and a hardcoded key. Update the affected release through ZTE and review registration, reset and account-management activity for unexpected changes.
ZTE Z80 Ultra Update Restricts Wi-Fi MAC Address Disclosure
A non-privileged application can retrieve the Wi-Fi MAC address on affected ZTE Z80 Ultra devices. Match the NX741J model and installed build, obtain the supported firmware update, and review untrusted applications.
CVE-2026-21385: Qualcomm graphics memory corruption
Qualcomm Graphics memory corruption affects devices with the specified component, not every Android phone. Match chipset and OEM firmware, obtain the manufacturer's update, and verify the patch level alongside actual component applicability.
CVE-2025-48595: Android Framework privilege escalation
Android Framework integer overflow can enable local privilege escalation beyond normal device permissions. Install the OEM security update and verify its reported patch level; this platform issue is not limited to Pixel devices.
CVE-2026-58704: Pixel cellular-modem privilege escalation
The exploited Pixel cellular-modem flaw can bypass permission checks. Install the current Pixel update, restart, and verify the security patch level; a successful update does not establish whether earlier exploitation occurred.