Advisories.

A crafted font causes a two-byte heap overflow during glyph shaping. Code execution is possible when a victim opens a malicious document.

Uploaded PDFs could reference internal URLs, which the renderer fetched. This exposed internal services and cloud instance metadata.

An exported activity forwarded untrusted intents, letting any installed app reach private components.

The pairing nonce resets on reboot. An attacker in radio range can recover the session key from two captured handshakes.

A race between two rename calls frees an object that is still referenced, leading to local privilege escalation.

A voltage glitch during boot skips signature verification. Requires physical access to the device.

User input can pollute Object.prototype and reach a code path that compiles attacker-controlled templates.

A wrong type assumption in the optimizing compiler gives JavaScript read and write access to memory.